Dashboards & Visualizations

How do I add two rows to create a new row in my table?

MachaMilkshake
Explorer

I have created a table with a series of outer joins.

I now have column 'Category', and another 6, call them A to F.

in Category, I have values N1 and N2, and I would like to create a new row with Category=N3, and values for A to F equals to the sum of those for N1 and N2. I've tried every possible thing I could find but couldn't get it to work, any help is appreciated, thanks! 

Current code looks something like this:

... queries & joins...

| table "Category" "A" ... "F"

Labels (1)
Tags (1)
0 Karma
1 Solution

tscroggins
Influencer

Ah, that detail wasn't clear from the original message. You can use the appendpipe command to stream the base search results through a subsearch and then append the subsearch results to base search results:

 

| makeresults format=csv data="Category,A,B,C,D,E,F
N1,1,2,4,2,4,1
N2,0,5,4,3,5,7
M1,1,0,1,0,4,3
M2,1,1,3,5,0,1
U1,0,4,6,5,4,3" 
| table Category *
| appendpipe 
    [| search Category=N* 
    | stats sum(*) as * 
    | eval Category="N3" ]

 

=>

CategoryABCDEF
N1124241
N2054357
M1101043
M2113501
U1046543
N3178598

View solution in original post

MachaMilkshake
Explorer

Fixed it myself with appendpipe

0 Karma

tscroggins
Influencer

Hi @MachaMilkshake,

The addcoltotals command should do exactly what you need:

| addcoltotals labelfield=Category label=N3
0 Karma

MachaMilkshake
Explorer

Hi thanks for the reply, I have more rows other than N1 and N2

0 Karma

tscroggins
Influencer

You can put whatever you want in the label argument. It sets the value of the field specified by labelfield in the totals row:

| addcoltotals labelfield=Category label="Total"

| addcoltotals labelfield=Category label="SUM[n1..nN]"

| addcoltotals labelfield=Category label="Life, the Universe and Everything"
0 Karma

MachaMilkshake
Explorer

Sorry I'm still not quite getting it, this is what I would like to achieve:

CategoryABCDEF
N1124241
N2054357
M1101043
M2113501
U1046543

I would like to create an additional row that is the sum of N1 and N2, and append it to the table above.

N3178598
0 Karma

tscroggins
Influencer

Ah, that detail wasn't clear from the original message. You can use the appendpipe command to stream the base search results through a subsearch and then append the subsearch results to base search results:

 

| makeresults format=csv data="Category,A,B,C,D,E,F
N1,1,2,4,2,4,1
N2,0,5,4,3,5,7
M1,1,0,1,0,4,3
M2,1,1,3,5,0,1
U1,0,4,6,5,4,3" 
| table Category *
| appendpipe 
    [| search Category=N* 
    | stats sum(*) as * 
    | eval Category="N3" ]

 

=>

CategoryABCDEF
N1124241
N2054357
M1101043
M2113501
U1046543
N3178598

tscroggins
Influencer

--if your base search includes N1, N2, N3, ... Nn, you can add additional logic to generate the N-value dynamically:

 

| appendpipe 
    [| search Category=N* 
    | stats count sum(*) as * 
    | eval Category="N".tostring(count+1)
    | fields - count ]

 

Or if you want to sub all Category values:

 

| appendpipe 
    [| rex field=Category "(?<Category>[^\d]+)"
    | stats count sum(*) as * by Category
    | eval Category=Category.tostring(count+1)
    | fields - count ]

 

=>

CategoryABCDEF
N1124241
N2054357
M1101043
M2113501
U1046543
M3214544
N3178598
U2046543

But note that you'll need to add custom sorting logic if you want something other than the default sort order.

MachaMilkshake
Explorer

I worked it out just now too with appendpipe, thanks a lot for your detailed response. I should've marked your response as the solution.. Thanks again!

Get Updates on the Splunk Community!

Observability Unlocked: Kubernetes Monitoring with Splunk Observability Cloud

 Ready to master Kubernetes and cloud monitoring like the pros? Join Splunk’s Growth Engineering team for an ...

Update Your SOAR Apps for Python 3.13: What Community Developers Need to Know

To Community SOAR App Developers - we're reaching out with an important update regarding Python 3.9's ...

October Community Champions: A Shoutout to Our Contributors!

As October comes to a close, we want to take a moment to celebrate the people who make the Splunk Community ...