https://community.splunk.com/t5/Splunk-Search/How-to-generate-a-search-that-will-sort-by-a-field-and-get/m-p/207958#M60603 <P>That worked perfectly. Thank you!</P> Thu, 03 Nov 2016 13:48:53 GMT sweenj 2016-11-03T13:48:53Z https://community.splunk.com/t5/Splunk-Search/How-to-generate-a-search-that-will-sort-by-a-field-and-get/m-p/207955#M60600 <P>I have a search string. </P> <PRE><CODE>index=data sourcetype=jobs QUEUE=myqueue| dedup JOBID | FIELDS CPU_USED, USER group by USER </CODE></PRE> <P>Each user can run multiple jobs, so I'll have duplicate USER names in the searched event. I'll also have varied CPU for each job the USER ran. </P> <P>I'd like to be able to do a search that aggregates the CPU_USED by USER. So if user1 runs 2 jobs in the time period, I can get CPU_USED from the first, job, and CPU_USED from the 2nd job, added together into an aggregate (sum) value. </P> <P>Could anyone assist with this?</P> Tue, 29 Sep 2020 11:39:57 GMT https://community.splunk.com/t5/Splunk-Search/How-to-generate-a-search-that-will-sort-by-a-field-and-get/m-p/207955#M60600 sweenj 2020-09-29T11:39:57Z https://community.splunk.com/t5/Splunk-Search/How-to-generate-a-search-that-will-sort-by-a-field-and-get/m-p/207956#M60601 <P>I belive you'll want to look here:</P> <P><A href="https://docs.splunk.com/Documentation/Splunk/6.5.0/SearchReference/Addcoltotals">https://docs.splunk.com/Documentation/Splunk/6.5.0/SearchReference/Addcoltotals</A></P> Wed, 02 Nov 2016 22:26:09 GMT https://community.splunk.com/t5/Splunk-Search/How-to-generate-a-search-that-will-sort-by-a-field-and-get/m-p/207956#M60601 rsennett_splunk 2016-11-02T22:26:09Z https://community.splunk.com/t5/Splunk-Search/How-to-generate-a-search-that-will-sort-by-a-field-and-get/m-p/207957#M60602 <P>You can try this to count the sum of CPU_USED for each USER</P> <PRE><CODE> index=data sourcetype=jobs QUEUE=myqueue| dedup JOBID | stats sum(CPU_USED) by USER </CODE></PRE> Wed, 02 Nov 2016 22:56:04 GMT https://community.splunk.com/t5/Splunk-Search/How-to-generate-a-search-that-will-sort-by-a-field-and-get/m-p/207957#M60602 ID_SplunkUser 2016-11-02T22:56:04Z https://community.splunk.com/t5/Splunk-Search/How-to-generate-a-search-that-will-sort-by-a-field-and-get/m-p/207958#M60603 <P>That worked perfectly. Thank you!</P> Thu, 03 Nov 2016 13:48:53 GMT https://community.splunk.com/t5/Splunk-Search/How-to-generate-a-search-that-will-sort-by-a-field-and-get/m-p/207958#M60603 sweenj 2016-11-03T13:48:53Z