Knowledge Management

How to search sum rows by column?

politrons
Explorer

Having this initial query I obtain a list of results order by Consumer, and pod

messages_number container_name="pol-sms-amh-throttler" | stats avg(messages_number) as consumer_node by Consumer, pod

 

splunk_1.PNG

 

Then I append a second stats where I want to sum all the values of pods by Consumer

messages_number container_name="pol-sms-amh-throttler" | stats avg(messages_number) as consumer_node by Consumer, pod | stats sum(consumer_node) as AvgConsumption by Consumer limit=0

 

splunk_2.PNG

Is this query correct and accurate about what I'm want to achieve? 

 

Also I don't know how can I see the AvgConsumptions  in a visualization

Labels (3)

politrons
Explorer

 you're not doing the same thing.

If we have 3 pods that are producing messages_number 3,4,2. What I want to know is that all of them are producing 9.

But with your query it will produce just 4 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

If you just want to sum them, try this

messages_number container_name="pol-sms-amh-throttler" | stats sum(messages_number) as TotalConsumption by Consumer limit=0

ITWhisperer
SplunkTrust
SplunkTrust

What you have will give you a number although I am not sure what significance it has - have you considered just doing it this way?

messages_number container_name="pol-sms-amh-throttler" | stats avg(messages_number) as AvgConsumption by Consumer limit=0
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Thanks for the Memories: .conf26 Took Learning to New Heights

Thank you, Splunk Community, for making .conf26 in Denver one for the books. From packed Splunk University ...

Best Practices: Splunk auto adjust pipeline queue

When you enable autoAdjustQueue in Splunk, maxSize should be understood as the queue size Splunk starts with ...

Splunk Auto Ingestion Parallel Pipeline Scaling

Why this feature matters Many Splunk environments experience ingestion pressure long before the host is fully ...