Knowledge Management

How to search sum rows by column?

politrons
Explorer

Having this initial query I obtain a list of results order by Consumer, and pod

messages_number container_name="pol-sms-amh-throttler" | stats avg(messages_number) as consumer_node by Consumer, pod

 

splunk_1.PNGsplunk_1.PNG

 

Then I append a second stats where I want to sum all the values of pods by Consumer

messages_number container_name="pol-sms-amh-throttler" | stats avg(messages_number) as consumer_node by Consumer, pod | stats sum(consumer_node) as AvgConsumption by Consumer limit=0

 

splunk_2.PNGsplunk_2.PNG

Is this query correct and accurate about what I'm want to achieve? 

 

Also I don't know how can I see the AvgConsumptions  in a visualization

Labels (3)

politrons
Explorer

 you're not doing the same thing.

If we have 3 pods that are producing messages_number 3,4,2. What I want to know is that all of them are producing 9.

But with your query it will produce just 4 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

If you just want to sum them, try this

messages_number container_name="pol-sms-amh-throttler" | stats sum(messages_number) as TotalConsumption by Consumer limit=0

ITWhisperer
SplunkTrust
SplunkTrust

What you have will give you a number although I am not sure what significance it has - have you considered just doing it this way?

messages_number container_name="pol-sms-amh-throttler" | stats avg(messages_number) as AvgConsumption by Consumer limit=0
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Agentic Operations Start with Context: Build the Right Data Foundation

Agentic Operations Start with Context: Build the Right Data Foundation   By Courtney Wright, Product Marketing ...

Assisted, Augmented or Agentic? Choose Your Splunk Starting Point

Assisted, Augmented or Agentic? Choose Your Splunk Starting Point   By Courtney Wright, Product Marketing ...

Session 2 | Beyond the Thread: Operationalizing AI with Confidence

Session 2   Beyond the Thread: Operationalizing AI with Confidence    The true power of the Cisco Data Fabric ...