topic Re: How to add a new row to my table that add the counts of three fields and subtract from another field? in Splunk Search

How to add a new row to my table that add the counts of three fields and subtract from another field?

avi7326 — Wed, 30 Aug 2023 16:03:34 GMT

I want to add three fields insert ,update and error then subtract it from count_carmen and add new row .

Re: How to add a new row to my table that add the counts of three fields and subtract from another field?

ITWhisperer — Wed, 30 Aug 2023 16:16:05 GMT

| addcoltotals count_carmen inserts updates errors | eval count_carmen=if(isnull(_time),count_carmen-inserts-updates-errors,count_carmen) | eval inserts=if(isnull(_time),null(),inserts) | eval updates=if(isnull(_time),null(),updates) | eval errors=if(isnull(_time),null(),errors)

Re: How to add a new row to my table that add the counts of three fields and subtract from another field?

avi7326 — Thu, 31 Aug 2023 09:33:01 GMT

It is giving me a new column and row what if I only wants a column of field name difference.

Re: How to add a new row to my table that add the counts of three fields and subtract from another field?

ITWhisperer — Thu, 31 Aug 2023 09:53:29 GMT

You literally said "add new row"!

If you just want the difference, try this

| eval difference=count_carmen-inserts-updates-errors

Re: How to add a new row to my table that add the counts of three fields and subtract from another field?

avi7326 — Thu, 31 Aug 2023 10:14:06 GMT

It is giving a wrong count. I want to add the insert+update+error. Then subtract it from count_carmen.

Re: How to add a new row to my table that add the counts of three fields and subtract from another field?

ITWhisperer — Thu, 31 Aug 2023 10:32:35 GMT

Remove these lines (they were only required when you had the extra row (that you originally asked for)

| eval inserts=if(isnull(_time),null(),inserts) | eval updates=if(isnull(_time),null(),updates) | eval errors=if(isnull(_time),null(),errors)

Re: How to add a new row to my table that add the counts of three fields and subtract from another field?

ITWhisperer — Thu, 31 Aug 2023 10:33:49 GMT

You could add this line if you want the total

| eval total=inserts+updates+errors