topic Re: How to sum of two result of appending subsearch in Total in Splunk Search

How to sum of two result of appending subsearch in Total

Manasi25 — Wed, 19 Aug 2020 06:43:47 GMT

Hi,

I have two OUTPUT as " IA" and "IB" in one chart by appending sub search.

I want addcoltotals of sum of "IA" and "IB"

My input -

source type = router routingKey=routingA OR routingKey=routingB

| stats sum(count) as count, avg(percent) as percent

| eval routingKey = "IA"
| append [ search routingKey=routingAA OR routingBB

| stats sum(count) as count, avg(percent) as percent

|eval routingKey = "IB" ]

| addcoltotals labelfield= routingKey label= “Total”

| table routingKey, count, percent

Result should be -

routingKey count percent

IA 50 50%

IB 50 50%

Total ? ?

Also, when i m searching result, its saying parsing job while giving output.

Do append command parsing my output? Is there any other command i can use instead of append.

Re: How to sum of two result of appending subsearch in Total

Nisha18789 — Wed, 19 Aug 2020 09:34:39 GMT

Hi @Manasi25 , what is the issue you are facing, as your query seems alright? Are you getting different result than what is expected or not getting any results at all? Also, I believe count and percent are existing fields in your logs, is that so?

Re: How to sum of two result of appending subsearch in Total

Manasi25 — Thu, 20 Aug 2020 00:48:44 GMT

the query - | addcoltotals labelfield= routingKey label= “Total” not resulting Output as below--

Total ? ?

Yes, count and percent are existing fields in my logs.

I need output in a table as below. Total of count and percentage of "IA" and "IB" in last row.

routingKey count percent

IA 50 50%

IB 50 50%

Total ? ?

I m getting only this -

IA 50 50%

IB 50 50%

I have mentions field values as well.here is my query --

source type = router routingKey=routingA OR routingKey=routingB

| stats sum(count) as count, avg(percent) as percent | eval routingKey = "IA"

| append [ search routingKey=routingAA OR routingBB

| stats sum(count) as count, avg(percent) as percent |eval routingKey = "IB" ]

| addcoltotals labelfield= routingKey label= “Total”

| table routingKey, count, percent

Re: How to sum of two result of appending subsearch in Total

Nisha18789 — Thu, 20 Aug 2020 07:10:21 GMT

Hi @Manasi25 , please use

| stats sum(count) as count, avg(percent) as percent | eval routingKey = "IA"

| append [ search routingKey=routingAA OR routingBB

| stats sum(count) as count, avg(percent) as percent |eval routingKey = "IB" ]

| addcoltotals labelfield=routingKey label=Total

| table routingKey, count, percent

Re: How to sum of two result of appending subsearch in Total

Manasi25 — Sun, 23 Aug 2020 09:59:12 GMT

Thanks ! Its worked.

I m using append query multiple times for different searches for same index.

Its parsing my job. Please advise solution.