https://community.splunk.com/t5/Splunk-Search/Aggregate-subtotal-the-output-by-locations-not-currently-an/m-p/341382#M101209 <P>hi,<BR /> Is the location mentioned in the events or you want to graph by iplocation?<BR /> It will be nice to see a sample of your events</P> Mon, 18 Sep 2017 12:56:37 GMT Sukisen1981 2017-09-18T12:56:37Z https://community.splunk.com/t5/Splunk-Search/Aggregate-subtotal-the-output-by-locations-not-currently-an/m-p/341381#M101208 <P>I have a query below that produces the sum of bandwidth used by remote intermediate forwarders. The output give me a simple linear output with sum by host.</P> <PRE><CODE>index=_internal metrics thruput site-hub 11001 host=server0* | stats sum(kb) by host </CODE></PRE> <P>What I am trying to get without success is to aggregate/subtotal the output by locations (not currently an index field) so that I can produce a graph by location rather than a graph by host.</P> Mon, 18 Sep 2017 12:52:39 GMT https://community.splunk.com/t5/Splunk-Search/Aggregate-subtotal-the-output-by-locations-not-currently-an/m-p/341381#M101208 tlmayes 2017-09-18T12:52:39Z https://community.splunk.com/t5/Splunk-Search/Aggregate-subtotal-the-output-by-locations-not-currently-an/m-p/341382#M101209 <P>hi,<BR /> Is the location mentioned in the events or you want to graph by iplocation?<BR /> It will be nice to see a sample of your events</P> Mon, 18 Sep 2017 12:56:37 GMT https://community.splunk.com/t5/Splunk-Search/Aggregate-subtotal-the-output-by-locations-not-currently-an/m-p/341382#M101209 Sukisen1981 2017-09-18T12:56:37Z https://community.splunk.com/t5/Splunk-Search/Aggregate-subtotal-the-output-by-locations-not-currently-an/m-p/341383#M101210 <P>No, there is no mention of location in the index, and assumed this field would be created via an eval statement. </P> <P>As for the events, they are standard for every Splunk deployment, output from the "metrics.log" adding the kb field. </P> Mon, 18 Sep 2017 13:08:02 GMT https://community.splunk.com/t5/Splunk-Search/Aggregate-subtotal-the-output-by-locations-not-currently-an/m-p/341383#M101210 tlmayes 2017-09-18T13:08:02Z https://community.splunk.com/t5/Splunk-Search/Aggregate-subtotal-the-output-by-locations-not-currently-an/m-p/341384#M101211 <P>So you need something that maps the hosts to the locations.</P> <P>This could be something like...</P> <PRE><CODE>| stats sum(kb) as totKb by host | join type=left host [something that gets your host to location mapping | table host location] | eval location=coalesce(location,"unknown") | stats sum(totKb) as totKb by location </CODE></PRE> <P>You could also use <CODE>lookup</CODE> or any number of other methods. </P> Mon, 18 Sep 2017 13:27:43 GMT https://community.splunk.com/t5/Splunk-Search/Aggregate-subtotal-the-output-by-locations-not-currently-an/m-p/341384#M101211 DalJeanis 2017-09-18T13:27:43Z https://community.splunk.com/t5/Splunk-Search/Aggregate-subtotal-the-output-by-locations-not-currently-an/m-p/341385#M101212 <P>Thanks... the lookup was the key (and the tree hiding in the forest). </P> Mon, 18 Sep 2017 15:10:30 GMT https://community.splunk.com/t5/Splunk-Search/Aggregate-subtotal-the-output-by-locations-not-currently-an/m-p/341385#M101212 tlmayes 2017-09-18T15:10:30Z https://community.splunk.com/t5/Splunk-Search/Aggregate-subtotal-the-output-by-locations-not-currently-an/m-p/341386#M101213 <P>@tlmayes - yep, I've wandered that forest many times in the last 8 months. Now it's just kind of "wave and a path appears..."</P> Mon, 18 Sep 2017 16:21:37 GMT https://community.splunk.com/t5/Splunk-Search/Aggregate-subtotal-the-output-by-locations-not-currently-an/m-p/341386#M101213 DalJeanis 2017-09-18T16:21:37Z