topic Re: How to add rows in table in Splunk Search

How to add rows in table

avi7326 — Fri, 14 Jul 2023 08:50:37 GMT

Status	Unit	Count
Duplicate	IT	5
Failure	BE	2
Success	DE	6
Success	IT	25
Success	PT	18
Success	DE	10
Success	PT	5
Total		71

I am adding the col total using the query
| addcoltotals label=status lable =total

But now I want to calculate the sum by Unit Like this-

After calculating the sum want to create an alert if any of the unit is 0 then it will create an alert.

IT	30
DE	16
PT	23
BE	2

Total	71

Re: How to add rows in table

ITWhisperer — Fri, 14 Jul 2023 08:56:06 GMT

Try this

| stats sum(count) as total by unit

However, this will only give you totals greater than zero because there is nothing to add if there are no counts. If you want your alert to pick up on there being no values for a unit, you will have to append a row for each unit with a count of zero before this sum.

Re: How to add rows in table

avi7326 — Fri, 14 Jul 2023 09:37:53 GMT

I want to do the total according to the status after calculating that I will check if the value is 0 for any unit It will create an alert

| stats sum(count) as total by unit

Using this it is not giving proper results .Do I have to remove addcolumns line.

Re: How to add rows in table

ITWhisperer — Fri, 14 Jul 2023 09:54:56 GMT

Yes, remove the addcoltotals line or move it to after the stats, but you will need to change the column name as well.

Re: How to add rows in table

avi7326 — Fri, 14 Jul 2023 11:18:04 GMT

Getting this table after using
|stats count as count by status Unit

Status	Unit	Count
Duplicate	IT	5
Failure	BE	2
Success	DE	6
Success	IT	25
Success	PT	18
Success	DE	10
Success	PT	5

But now I want it by the sum of unit according to the second table which given earlier.

| stats sum(count) as total by unit

This is not giving me the expected result.

Re: How to add rows in table

ITWhisperer — Fri, 14 Jul 2023 11:46:06 GMT

Please show what you expect the result to be

Re: How to add rows in table

avi7326 — Fri, 14 Jul 2023 11:47:22 GMT

I got it thanks