Dashboards & Visualizations

How do I add two rows to create a new row in my table?

MachaMilkshake
Explorer

I have created a table with a series of outer joins.

I now have column 'Category', and another 6, call them A to F.

in Category, I have values N1 and N2, and I would like to create a new row with Category=N3, and values for A to F equals to the sum of those for N1 and N2. I've tried every possible thing I could find but couldn't get it to work, any help is appreciated, thanks! 

Current code looks something like this:

... queries & joins...

| table "Category" "A" ... "F"

Labels (1)
Tags (1)
0 Karma
1 Solution

tscroggins
Influencer

Ah, that detail wasn't clear from the original message. You can use the appendpipe command to stream the base search results through a subsearch and then append the subsearch results to base search results:

 

| makeresults format=csv data="Category,A,B,C,D,E,F
N1,1,2,4,2,4,1
N2,0,5,4,3,5,7
M1,1,0,1,0,4,3
M2,1,1,3,5,0,1
U1,0,4,6,5,4,3" 
| table Category *
| appendpipe 
    [| search Category=N* 
    | stats sum(*) as * 
    | eval Category="N3" ]

 

=>

CategoryABCDEF
N1124241
N2054357
M1101043
M2113501
U1046543
N3178598

View solution in original post

MachaMilkshake
Explorer

Fixed it myself with appendpipe

0 Karma

tscroggins
Influencer

Hi @MachaMilkshake,

The addcoltotals command should do exactly what you need:

| addcoltotals labelfield=Category label=N3
0 Karma

MachaMilkshake
Explorer

Hi thanks for the reply, I have more rows other than N1 and N2

0 Karma

tscroggins
Influencer

You can put whatever you want in the label argument. It sets the value of the field specified by labelfield in the totals row:

| addcoltotals labelfield=Category label="Total"

| addcoltotals labelfield=Category label="SUM[n1..nN]"

| addcoltotals labelfield=Category label="Life, the Universe and Everything"
0 Karma

MachaMilkshake
Explorer

Sorry I'm still not quite getting it, this is what I would like to achieve:

CategoryABCDEF
N1124241
N2054357
M1101043
M2113501
U1046543

I would like to create an additional row that is the sum of N1 and N2, and append it to the table above.

N3178598
0 Karma

tscroggins
Influencer

Ah, that detail wasn't clear from the original message. You can use the appendpipe command to stream the base search results through a subsearch and then append the subsearch results to base search results:

 

| makeresults format=csv data="Category,A,B,C,D,E,F
N1,1,2,4,2,4,1
N2,0,5,4,3,5,7
M1,1,0,1,0,4,3
M2,1,1,3,5,0,1
U1,0,4,6,5,4,3" 
| table Category *
| appendpipe 
    [| search Category=N* 
    | stats sum(*) as * 
    | eval Category="N3" ]

 

=>

CategoryABCDEF
N1124241
N2054357
M1101043
M2113501
U1046543
N3178598

tscroggins
Influencer

--if your base search includes N1, N2, N3, ... Nn, you can add additional logic to generate the N-value dynamically:

 

| appendpipe 
    [| search Category=N* 
    | stats count sum(*) as * 
    | eval Category="N".tostring(count+1)
    | fields - count ]

 

Or if you want to sub all Category values:

 

| appendpipe 
    [| rex field=Category "(?<Category>[^\d]+)"
    | stats count sum(*) as * by Category
    | eval Category=Category.tostring(count+1)
    | fields - count ]

 

=>

CategoryABCDEF
N1124241
N2054357
M1101043
M2113501
U1046543
M3214544
N3178598
U2046543

But note that you'll need to add custom sorting logic if you want something other than the default sort order.

MachaMilkshake
Explorer

I worked it out just now too with appendpipe, thanks a lot for your detailed response. I should've marked your response as the solution.. Thanks again!

Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Tech Talk Recap | Mastering Threat Hunting

Mastering Threat HuntingDive into the world of threat hunting, exploring the key differences between ...

Observability for AI Applications: Troubleshooting Latency

If you’re working with proprietary company data, you’re probably going to have a locally hosted LLM or many ...

Splunk AI Assistant for SPL vs. ChatGPT: Which One is Better?

In the age of AI, every tool promises to make our lives easier. From summarizing content to writing code, ...