topic Re: How to Summarize (stats) Output. in Splunk Search

How to Summarize (stats) Output.

albyva — Tue, 15 Apr 2014 15:19:41 GMT

Right now I have a search which outputs the following:

| stats latest(bps_out) AS CurrentBPS BY Gateway,Hub,Interface,MaxSpeed

Gateway Hub Interface MaxSpeed CurrentBPS

router1.boston Boston so-0/0/0.0 10000000000 3843026418

router2.boston Boston so-0/0/1.0 10000000000 3813472541

What I'm trying to do is sum up this data by Hub so that it looks like:

Hub MaxSpeed CurrentBPS

Boston 20000000000 7656498959

The end result being a culmination of data per Hub. I tried using bucket and transaction, but just couldn't get it to work right. Maybe eval will work, but I wasn't skilled enough to get that working either. Any suggestions are greatly appreciated.

Thanks,

Re: How to Summarize (stats) Output.

martin_mueller — Tue, 15 Apr 2014 15:35:41 GMT

Something like this?

<search> | stats latest(bps_out) AS CurrentBPS BY Gateway,Hub,Interface,MaxSpeed | stats sum(MaxSpeed) sum(CurrentBPS) by Hub

Re: How to Summarize (stats) Output.

albyva — Tue, 15 Apr 2014 15:48:20 GMT

It's always the simple things that get you. 🙂
Thanks, that did it.