Reporting

How do I sum the total of appendcol results with option to format the field name?

jamesbabugm
New Member

looking for a query to convert the results like this

I have a search to produce report using appendcols

a | b | c

5785|5731|100

want to get the report like this, basically trying to format the name of the fields along with apply sum/diff

Total of messagea | Total of messageb | Total of messagec | Diff of Total a and total b
5785|5731|100|54

This is the current query 


index!= "internal " sourcetype="a" "messagea" | stats count as a |
appendcols [search index!= "internal" sourcetype="b" "messageb" | stats count as b ] |
appendcols [search index!= "internal" sourcetype="c" "messagec" | stats count as c ]

Labels (1)
0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@jamesbabugm 

You can eval the diff between total a & total b and then rename fields.

Like

index!= "internal " sourcetype="a" "messagea" | stats count as a |
appendcols [search index!= "internal" sourcetype="b" "messageb" | stats count as b ] |
appendcols [search index!= "internal" sourcetype="c" "messagec" | stats count as c ]
| eval diff = a - b
| table a b c diff
| rename a as "Total of Message a", b as "Total of Message b", c as "Total of Message c", diff as "Diff of Total a and Total b"

 

You can change the search as per your requirement.  

https://docs.splunk.com/Documentation/Splunk/9.0.3/SearchReference/Eval

https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Rename

 

I hope this will help you.

Thanks
KV
If any of my replies help you to solve the problem Or gain knowledge, an upvote would be appreciated.

0 Karma
Get Updates on the Splunk Community!

Modernize your Splunk Apps – Introducing Python 3.13 in Splunk

We are excited to announce that the upcoming releases of Splunk Enterprise 10.2.x and Splunk Cloud Platform ...

New Release | Splunk Cloud Platform 10.1.2507

Hello Splunk Community!We are thrilled to announce the General Availability of Splunk Cloud Platform 10.1.2507 ...

🌟 From Audit Chaos to Clarity: Welcoming Audit Trail v2

🗣 You Spoke, We Listened  Audit Trail v2 wasn’t written in isolation—it was shaped by your voices.  In ...