topic Contingency Total Rows in Splunk Search

Contingency Total Rows

IRHM73 — Fri, 06 Nov 2015 08:21:59 GMT

Hi I wonder whether someone may be able to help me please.

Using an adapted solution from @woodcock I'm using the query below, I'm creating a table as follows:

Manage List
TOTAL
View Payments
TOTAL
What Do You Think
TOTAL

Then column headings "1 (HS)", "2 (HS)" etc.

index=main auditSource=frontend auditType=ExitSurvey |replace /survey With "Manage List"| contingency tags.path detail.manageList | append   [search index=main auditSource=agent-frontend auditType=ExitSurvey |replace /survey With "View Payments" |contingency tags.path detail.viewPayments ]  |append   [search index=main auditSource=frontend auditType=ExitSurvey |replace /survey With "What Do You Think" |contingency tags.path detail.whatDoYouThink] | rename tags.path TO "Question" | fields Question, 1, 2, 3, 4, 5 | fields - TOTAL | rename 1 TO "1 (HS)", 2 TO " 2 (HS)", 3 TO "3 (HS)", 4 TO "4 (HS)", 5 TO "5 (HS)"

Could someone tell me please is there a way to remove the "TOTAL" rows.

Many thanks and kind regards

Chris

Re: Contingency Total Rows

sundareshr — Tue, 29 Sep 2020 07:49:50 GMT

Try | search your_fieldname_here != "TOTAL" ?

Re: Contingency Total Rows

IRHM73 — Mon, 09 Nov 2015 06:44:57 GMT

Hi @sundareshr, thank you for taking the time to come back to me with this.

I've tried the suggestion you kindly provided as:

index=main auditSource=frontend auditType=ExitSurvey != "TOTAL"
|replace /survey With "Manage List"
| contingency tags.path detail.manageList
| append [search index=main auditSource=frontend auditType=ExitSurvey  
|replace /survey With "View Payments" |contingency tags.path detail.viewPayments ]  
|append [search index=main auditSource=frontend auditType=ExitSurvey 
|replace /survey With "What Do You Think" 
|contingency tags.path detail.whatDoYouThink] 
| rename tags.path TO "Question" 
| fields Question, 1 2, 3, 4, 5 
| fields - TOTAL 
| rename 1 TO "1 (HS)", 2 TO " 2 (HS)", 3 TO "3 (HS)", 4 TO "4 (HS)", 5 TO "5 (HS)"

But unfortunately when I run this, I receive a 'Parser' error.

Many thanks and kind regards

Chris

Re: Contingency Total Rows

sundareshr — Mon, 09 Nov 2015 15:42:45 GMT

Chris,

Couple of observations

1) != is a comparison operator, should be used to compare field values. In this specific instance, what you need is a boolean operator (NOT). here's some light reading on this subject http://docs.splunk.com/Documentation/Splunk/6.2.0/Search/Usethesearchcommand

2) Since you want to filter out the TOTAL row, after the contingency commands, you will have to do you search after as well. Adding something like this, before your rename command, should work

... | search tags.path!="TOTAL"

Re: Contingency Total Rows

IRHM73 — Tue, 10 Nov 2015 07:00:19 GMT

Hi, thank you very much for coming back to me with this. It works great! If you would like to put this as an answer I can 'Accept' it.

Thank you also for the link which I'll be studying today.

Kind Regards

Chris

Re: Contingency Total Rows

sundareshr — Tue, 10 Nov 2015 13:53:43 GMT

@IRHM73 I've changed it to an answer.

Chris,

Couple of observations

2) Since you want to filter out the TOTAL row, after the contingency commands, you will have to do you search after as well. Adding something like this, before your rename command, should work

... | search tags.path!="TOTAL"

Re: Contingency Total Rows

_jgpm_ — Tue, 26 Sep 2017 21:12:00 GMT

The auto-help on contingency told me that you add "usetotals=F" as the last option will get rid of the TOTALS row.