Archive
Highlighted

Contingency Total Rows

Motivator

Hi I wonder whether someone may be able to help me please.

Using an adapted solution from @woodcock I'm using the query below, I'm creating a table as follows:

Manage List
TOTAL
View Payments
TOTAL
What Do You Think
TOTAL

Then column headings "1 (HS)", "2 (HS)" etc.

index=main auditSource=frontend auditType=ExitSurvey |replace /survey With "Manage List"| contingency tags.path detail.manageList | append   [search index=main auditSource=agent-frontend auditType=ExitSurvey |replace /survey With "View Payments" |contingency tags.path detail.viewPayments ]  |append   [search index=main auditSource=frontend auditType=ExitSurvey |replace /survey With "What Do You Think" |contingency tags.path detail.whatDoYouThink] | rename tags.path TO "Question" | fields Question, 1, 2, 3, 4, 5 | fields - TOTAL | rename 1 TO "1 (HS)", 2 TO " 2 (HS)", 3 TO "3 (HS)", 4 TO "4 (HS)", 5 TO "5 (HS)"

Could someone tell me please is there a way to remove the "TOTAL" rows.

Many thanks and kind regards

Chris

0 Karma
Highlighted

Re: Contingency Total Rows

Legend

Try | search yourfieldnamehere != "TOTAL" ?

0 Karma
Highlighted

Re: Contingency Total Rows

Motivator

Hi @sundareshr, thank you for taking the time to come back to me with this.

I've tried the suggestion you kindly provided as:

index=main auditSource=frontend auditType=ExitSurvey != "TOTAL"
|replace /survey With "Manage List"
| contingency tags.path detail.manageList
| append [search index=main auditSource=frontend auditType=ExitSurvey  
|replace /survey With "View Payments" |contingency tags.path detail.viewPayments ]  
|append [search index=main auditSource=frontend auditType=ExitSurvey 
|replace /survey With "What Do You Think" 
|contingency tags.path detail.whatDoYouThink] 
| rename tags.path TO "Question" 
| fields Question, 1 2, 3, 4, 5 
| fields - TOTAL 
| rename 1 TO "1 (HS)", 2 TO " 2 (HS)", 3 TO "3 (HS)", 4 TO "4 (HS)", 5 TO "5 (HS)"

But unfortunately when I run this, I receive a 'Parser' error.

Many thanks and kind regards

Chris

0 Karma
Highlighted

Re: Contingency Total Rows

Legend

Chris,

Couple of observations

1) != is a comparison operator, should be used to compare field values. In this specific instance, what you need is a boolean operator (NOT). here's some light reading on this subject http://docs.splunk.com/Documentation/Splunk/6.2.0/Search/Usethesearchcommand

2) Since you want to filter out the TOTAL row, after the contingency commands, you will have to do you search after as well. Adding something like this, before your rename command, should work

... | search tags.path!="TOTAL" 
0 Karma
Highlighted

Re: Contingency Total Rows

Motivator

Hi, thank you very much for coming back to me with this. It works great! If you would like to put this as an answer I can 'Accept' it.

Thank you also for the link which I'll be studying today.

Kind Regards

Chris

0 Karma
Highlighted

Re: Contingency Total Rows

Legend

@IRHM73 I've changed it to an answer.

Chris,

Couple of observations

1) != is a comparison operator, should be used to compare field values. In this specific instance, what you need is a boolean operator (NOT). here's some light reading on this subject http://docs.splunk.com/Documentation/Splunk/6.2.0/Search/Usethesearchcommand

2) Since you want to filter out the TOTAL row, after the contingency commands, you will have to do you search after as well. Adding something like this, before your rename command, should work

... | search tags.path!="TOTAL" 

View solution in original post

0 Karma
Highlighted

Re: Contingency Total Rows

Communicator

The auto-help on contingency told me that you add "usetotals=F" as the last option will get rid of the TOTALS row.

0 Karma