topic Re: adding value output rows from a stats table in Splunk Search

adding value output rows from a stats table

rhallinan — Mon, 27 Sep 2021 16:57:43 GMT

I have the following search.

index=main_index sourcetype="hec:google" operationName=createMobileAuthenticationOutcome direction=response source="customers-mobile-authentications-v1"
| dedup correlationId
| stats count by eventData.log{}.downstreamRequestAdditionalLog.request.applicationEntryType eventData.log{}.downstreamRequestAdditionalLog.request.authenticationOutcome
| sort -count
| eventstats sum(count) as tot by eventData.log{}.downstreamRequestAdditionalLog.request.applicationEntryType
| eval perc = round(count/tot*100,1)
| stats list(eventData.log{}.downstreamRequestAdditionalLog.request.authenticationOutcome) as "OutCome Request Details" list(count) as Count, list(perc) as "% per Auth Type" by eventData.log{}.downstreamRequestAdditionalLog.request.applicationEntryType
| appendpipe
[ stats sum(Count) as Count, sum("% per Auth Type") as "% per Auth Type" by eventData.log{}.downstreamRequestAdditionalLog.request.applicationEntryType
| eval "OutCome Request Details" = "Total Request"]
| sort eventData.log{}.downstreamRequestAdditionalLog.request.applicationEntryType
| rename eventData.log{}.downstreamRequestAdditionalLog.request.applicationEntryType as "Auth Type"

which shows this table. But....

What I want to do is add another row for the total number of directOpenApp.Completed and pushNotifications.Completed

I've tried addtotals and can't get my head around appendcols.

Thanks

Re: adding value output rows from a stats table

richgalloway — Mon, 27 Sep 2021 21:06:34 GMT

It sounds like you're wanting to add a subtotal column. If so, see the examples for the appendpipe command (https://docs.splunk.com/Documentation/Splunk/8.2.2/SearchReference/Appendpipe#Examples) for how to that.

Re: adding value output rows from a stats table

PickleRick — Mon, 27 Sep 2021 23:22:55 GMT

appendpipe sounds great but it won't work that straightforward with multivalued fields.

I can't seem to be able to do a "dynamic addressing" of multivalued fields so I could mvfind a position in one list and find a value in another one (something like field.(mvfind(another_field,"value")) - it doesn't work).

Furthermore, expanding mvfields with mvexpand - well, you can't do it "pairwise". You could do mvzip to produce pairs but it's getting even more ugly and you still have filtering ahead of you. Ugly as hell.

So I'd rather skip the "stats list" from the original search. Or at least moved it way to the end - until all the calculations are complete.