https://community.splunk.com/t5/Splunk-Search/In-a-table-how-to-calculate-sum-of-the-values-of-one-column/m-p/369520#M164064 <P>What it should do is create a new column with the values for both of those uris and then the Rex command should remove the sec label and addcoltotals should sum up the new column with the value on a new row at the bottom of the table. </P> <P>You’re not seeing the eval command bring both uris into the new field or the rex command Work?</P> Wed, 03 Jan 2018 11:45:09 GMT cmerriman 2018-01-03T11:45:09Z https://community.splunk.com/t5/Splunk-Search/In-a-table-how-to-calculate-sum-of-the-values-of-one-column/m-p/369517#M164061 <P>The table output of my splunk query gives me an output like this.</P> <P><STRONG>uri | transaction_time</STRONG><BR /> /se/al/st/o1 | 97 sec<BR /> <EM>/post/em/sec/w</EM> | 16 sec<BR /> /ret/jim/st/sem | 20 sec<BR /> /got/em/sec/w/2 | 33 sec<BR /> <EM>/gt/ey/sec/d/3</EM> | 21 sec<BR /> /st/em/sec/65 | 12 sec</P> <P>I want an add-total of my coulmn "transaction_time" , but it shouldn't add all the values there.<BR /> It should only add the values between the uri column value "/post/em/sec/w" and "/gt/ey/sec/d/" .<BR /> i.e. 16 + 20+ 33+ 21 </P> Tue, 02 Jan 2018 11:42:51 GMT https://community.splunk.com/t5/Splunk-Search/In-a-table-how-to-calculate-sum-of-the-values-of-one-column/m-p/369517#M164061 zacksoft 2018-01-02T11:42:51Z https://community.splunk.com/t5/Splunk-Search/In-a-table-how-to-calculate-sum-of-the-values-of-one-column/m-p/369518#M164062 <P>try adding something like this to the end of your query:</P> <PRE><CODE>|eval trans_time=if(uri="/post/em/sec/w" OR uri="/gt/ey/sec/d/",transaction_time,null())|rex field=trans_time mode=sed "s/ sec//g"|addcoltotals trans_time </CODE></PRE> Tue, 02 Jan 2018 13:07:52 GMT https://community.splunk.com/t5/Splunk-Search/In-a-table-how-to-calculate-sum-of-the-values-of-one-column/m-p/369518#M164062 cmerriman 2018-01-02T13:07:52Z https://community.splunk.com/t5/Splunk-Search/In-a-table-how-to-calculate-sum-of-the-values-of-one-column/m-p/369519#M164063 <P>Hi @cmerriman<BR /> I tried this. It creates another column and gives the value of /post/em/sec/w only. (i.e. 16 sec).<BR /> It is not adding the sum from "/post/em/sec/w" and "/gt/ey/sec/d/" .</P> Wed, 03 Jan 2018 07:58:17 GMT https://community.splunk.com/t5/Splunk-Search/In-a-table-how-to-calculate-sum-of-the-values-of-one-column/m-p/369519#M164063 zacksoft 2018-01-03T07:58:17Z https://community.splunk.com/t5/Splunk-Search/In-a-table-how-to-calculate-sum-of-the-values-of-one-column/m-p/369520#M164064 <P>What it should do is create a new column with the values for both of those uris and then the Rex command should remove the sec label and addcoltotals should sum up the new column with the value on a new row at the bottom of the table. </P> <P>You’re not seeing the eval command bring both uris into the new field or the rex command Work?</P> Wed, 03 Jan 2018 11:45:09 GMT https://community.splunk.com/t5/Splunk-Search/In-a-table-how-to-calculate-sum-of-the-values-of-one-column/m-p/369520#M164064 cmerriman 2018-01-03T11:45:09Z https://community.splunk.com/t5/Splunk-Search/In-a-table-how-to-calculate-sum-of-the-values-of-one-column/m-p/369521#M164065 <P>I have removed the sec from the base search so the sec is no more present but just the numeric value.</P> Wed, 03 Jan 2018 11:51:13 GMT https://community.splunk.com/t5/Splunk-Search/In-a-table-how-to-calculate-sum-of-the-values-of-one-column/m-p/369521#M164065 zacksoft 2018-01-03T11:51:13Z https://community.splunk.com/t5/Splunk-Search/In-a-table-how-to-calculate-sum-of-the-values-of-one-column/m-p/369522#M164066 <P>And it shouldn't add both those uri. It should add all the values present between those 2 uris.</P> Wed, 03 Jan 2018 11:52:45 GMT https://community.splunk.com/t5/Splunk-Search/In-a-table-how-to-calculate-sum-of-the-values-of-one-column/m-p/369522#M164066 zacksoft 2018-01-03T11:52:45Z https://community.splunk.com/t5/Splunk-Search/In-a-table-how-to-calculate-sum-of-the-values-of-one-column/m-p/369523#M164067 <P>It should keep adding the values from "/post/em/sec/w" until it encounters "/gt/ey/sec/d/" . Currently it is only adding an showing the value of /post/em/sec/w i.e. 16.</P> Wed, 03 Jan 2018 12:02:16 GMT https://community.splunk.com/t5/Splunk-Search/In-a-table-how-to-calculate-sum-of-the-values-of-one-column/m-p/369523#M164067 zacksoft 2018-01-03T12:02:16Z https://community.splunk.com/t5/Splunk-Search/In-a-table-how-to-calculate-sum-of-the-values-of-one-column/m-p/369524#M164068 <P>What do you see in the fields shown that indicates the start and end of the values that should be included in your sum? Based on your question it's unclear, as there appears to be no commonality between the rows <CODE>/post/em/sec/w</CODE> and <CODE>/gt/ey/sec/d/3</CODE> (which is what I assume you meant instead of /gt/ey/sec/d, which doesn't exist).</P> Wed, 03 Jan 2018 15:32:11 GMT https://community.splunk.com/t5/Splunk-Search/In-a-table-how-to-calculate-sum-of-the-values-of-one-column/m-p/369524#M164068 micahkemp 2018-01-03T15:32:11Z