topic Re: How to add multiple duration from multiple independent transactions in Splunk Search

How to add multiple duration from multiple independent transactions

smhsplunk — Wed, 12 Oct 2016 23:53:16 GMT

So I am running multiple single valued transactions and putting the values in eval keywords, but I want to add all these new values to get the total value (duration1+duration2+....) and show it in another panel. Here is my following transactions I am running. They are all run separate inside a single row

index=main host=host1 | transaction startswith="keyword1" endswith="keyword1_ending" | eval keyword1_duration = duration | stats sum(keyword1_duration)
index=main host=host1 | transaction startswith="keyword2" endswith="keyword2_ending" | eval keyword2_duration = duration | stats sum(keyword2_duration)

how do I add these values ? Do I have to define a token on each block to use that value across panels ?

Re: How to add multiple duration from multiple independent transactions

sundareshr — Thu, 13 Oct 2016 00:17:55 GMT

Can an event have more than one keyword (start or end)?

Re: How to add multiple duration from multiple independent transactions

somesoni2 — Thu, 13 Oct 2016 03:28:23 GMT

If you're using Splunk 6.3 and above, something like this would work. (Update the queries accourdingly). (Run Anywhere sample)

<dashboard>
  <label>PanelsWithTokenAdd</label>
  <row>
    <panel>
      <single>
        <title>Sourcetype count</title>
        <search>
          <query>index=_internal | stats dc(sourcetype) as sourcetypes</query>
          <earliest>@d</earliest>
          <latest>now</latest>
          <done>
            <set token="sourcetypes">$result.sourcetypes$</set>
          </done>
        </search>
      </single>
    </panel>
    <panel>
      <single>
        <title>Sources</title>
        <search>
          <query>index=_internal | stats dc(source) as sources</query>
          <earliest>-60m@m</earliest>
          <latest>now</latest>
          <done>
            <set token="sources">$result.sources$</set>
          </done>
        </search>
      </single>
    </panel>
    <panel>
      <single>
        <title>Sourcetypes + Source</title>
        <search>
          <query>| gentimes start=-1 | eval sourcetypes="$sourcetypes$" | eval sources="$sources$" | eval all=sourcetypes+sources | table all</query>
          <earliest>@d</earliest>
          <latest>now</latest>
        </search>
      </single>
    </panel>
  </row>
</dashboard>

Re: How to add multiple duration from multiple independent transactions

smhsplunk — Thu, 13 Oct 2016 17:19:57 GMT

Great this works! How do I put default value of tokens to zero ?

Re: How to add multiple duration from multiple independent transactions

somesoni2 — Thu, 13 Oct 2016 18:13:35 GMT

Try replacing | eval all=sourcetypes+sources with | eval all=coalesce(sourcetypes+sources,0) in 3rd panel search.