topic Re: Calculate SUM by type in Splunk Search

How to calculate SUM by type?

Neel881 — Wed, 26 Jul 2023 17:59:25 GMT

Hello everyone,

I am trying to SUM the columns.

index="nzc-neel-uttar" source="http:kyhkp" | timechart span=1d count by Type | eval "New_Date"=strftime(_time,"%Y-%m-%d")

Desired Output:

Please suggest

Thanks

ITWhisperer — Wed, 26 Jul 2023 13:45:15 GMT

index="nzc-neel-uttar" source="http:kyhkp" | timechart span=1d count by Type | addtotals row=t | eval "New_Date"=strftime(_time,"%Y-%m-%d")

Neel881 — Wed, 26 Jul 2023 14:25:46 GMT

Its working fine, thank you so much!

How to add others columns from the index? Ex: Phase from the same index.

Also, remove and rearrange the columns sequence, mentioned in the above table.

ITWhisperer — Wed, 26 Jul 2023 17:06:25 GMT

Unless Phase can be derived from your current results, you could potentially use appendcols, but it depends on your data.