Grouping search results
The from command also supports aggregation using the GROUP BY clause in conjunction with aggregate functions calls in the SELECT clause like this:
FROM main WHERE earliest=-5m@m AND latest=@m GROUP BY host SELECT sum(bytes) AS sum, host
Next step
See Filtering data.
Last modified on 21 April, 2020
| Combining commands | Filtering data |
This documentation applies to the following versions of Splunk® Cloud Services: current
Download manual
Feedback submitted, thanks!