topic Re: Add a summary row to a statistics table in Splunk Search

Add a summary row to a statistics table

dbcase — Mon, 29 Aug 2016 16:22:15 GMT

Hi,

I have this search:

index=mso_statistics sourcetype=ic_connectivity_5min-too_small stat_name = "cell" |eval mso = upper(substr(mso,1,1)).lower(substr(mso,2)) |stats sparkline(avg(stat_val)) as "Trend" first(stat_val) as "Current Cell Connectivity %" by mso|rename mso as "MSO - Click for Expanded View"

Which produces this Statistics Table (first column intentionally omitted)

What I'd like to do is append to the table at the bottom a row that indicates Avg, mean, etc of the data. I've tired append and appendpipe but the data never seems to display. (note: I've never used append or appendpipe before so it is VERY likely it is something I'm doing wrong)

Re: Add a summary row to a statistics table

dbcase — Mon, 29 Aug 2016 16:32:58 GMT

updated query, a bit closer but still not quite there

This one does get an entry into the first column (the one that was omitted) but no entry in the last column

index=mso_statistics sourcetype=ic_connectivity_5min-too_small stat_name = "cell" |eval mso = upper(substr(mso,1,1)).lower(substr(mso,2)) |appendpipe [stats avg(stat_val) as "Current Cell Connectivity %" | eval mso = "ALL MSO's"]|stats sparkline(avg(stat_val)) as "Trend" first(stat_val) as "Current Cell Connectivity %" by mso|rename mso as "MSO - Click for Expanded View"

Re: Add a summary row to a statistics table

sundareshr — Mon, 29 Aug 2016 16:40:23 GMT

Try moving the appendpipe to after the stats command. Like this

 index=mso_statistics sourcetype=ic_connectivity_5min-too_small stat_name = "cell" |eval mso = upper(substr(mso,1,1)).lower(substr(mso,2)) |stats sparkline(avg(stat_val)) as "Trend" first(stat_val) as "Current Cell Connectivity %" by mso |appendpipe [stats avg(stat_val) as "Current Cell Connectivity %" | eval mso = "ALL MSO's"] |rename mso as "MSO - Click for Expanded View"

Re: Add a summary row to a statistics table

dbcase — Mon, 29 Aug 2016 16:44:54 GMT

Hi Sundareshr,

I tried that one as well hoping it would do the trick but when I do the resulting table doesn't have any of the entries.

Meaning, no average and no "ALL MSO's" in the first column. I only got the ALL MSO's to show up when I put the appendpipe before the stats command

Re: Add a summary row to a statistics table

sundareshr — Mon, 29 Aug 2016 16:48:47 GMT

Then try this..

 index=mso_statistics sourcetype=ic_connectivity_5min-too_small stat_name = "cell" |eval mso = upper(substr(mso,1,1)).lower(substr(mso,2)) |stats sparkline(avg(stat_val)) as "Trend" first(stat_val) as "Current Cell Connectivity %" by mso |append [search index=mso_statistics sourcetype=ic_connectivity_5min-too_small stat_name = "cell" |eval mso = upper(substr(mso,1,1)).lower(substr(mso,2))  
 stats avg(stat_val) as "Current Cell Connectivity %" | eval mso = "ALL MSO's"] |rename mso as "MSO - Click for Expanded View"

Re: Add a summary row to a statistics table

dbcase — Mon, 29 Aug 2016 16:53:16 GMT

BINGO!!!! Thank you Sundareshr!!!!