https://community.splunk.com/t5/Splunk-Search/How-to-write-search-query-with-two-commands/m-p/29941#M6053 <P>Sounds like you could use the addtotals search command so try the following search query: your_search | addtotals</P> Fri, 17 Jun 2011 08:46:12 GMT Ant1D 2011-06-17T08:46:12Z https://community.splunk.com/t5/Splunk-Search/How-to-write-search-query-with-two-commands/m-p/29940#M6052 <P>Hello,</P> <P>I have 3 guest and each guest has 10 hosts in it. i want to display data in pie chart.</P> <P>my query conditions are :</P> <P>Want to display sum of latest value over hosts by guest.<BR /> First i need to find out latest values of host and then sum up that values guest.</P> <P>My current query is:-</P> <P>index="test" sourcetype="power_usage" | eval guest=ltrim(source,"/opt/app/powersupply/") | eval guest=split(guest,"/") | eval guest=mvindex(guest,-3) | chart first(Power_consumption) as a over host by guest </P> <P>This query is giving latest values of hosts by guest. Next i need to sum up latest values. What would be the approach to do this. </P> <P>Please help, if anybody knows the solution.</P> <P>Thanks in advance.</P> <P>Geetanjali</P> Mon, 28 Sep 2020 09:41:05 GMT https://community.splunk.com/t5/Splunk-Search/How-to-write-search-query-with-two-commands/m-p/29940#M6052 geetanjali 2020-09-28T09:41:05Z https://community.splunk.com/t5/Splunk-Search/How-to-write-search-query-with-two-commands/m-p/29941#M6053 <P>Sounds like you could use the addtotals search command so try the following search query: your_search | addtotals</P> Fri, 17 Jun 2011 08:46:12 GMT https://community.splunk.com/t5/Splunk-Search/How-to-write-search-query-with-two-commands/m-p/29941#M6053 Ant1D 2011-06-17T08:46:12Z https://community.splunk.com/t5/Splunk-Search/How-to-write-search-query-with-two-commands/m-p/29942#M6054 <P>Keep your original search for the first need and use this one for the other need:</P> <PRE><CODE>index="test" sourcetype="power_usage" | eval guest=ltrim(source,"/opt/app/powersupply/") | eval guest=split(guest,"/") | eval guest=mvindex(guest,-3) | stats first(Power_consumption) as a BY host,guest | stats sum(a) BY host </CODE></PRE> Thu, 28 May 2015 23:02:28 GMT https://community.splunk.com/t5/Splunk-Search/How-to-write-search-query-with-two-commands/m-p/29942#M6054 woodcock 2015-05-28T23:02:28Z