Splunk Enterprise

How to add column values ?

Muthu_Vinith
Path Finder




0 Karma

richgalloway
SplunkTrust
SplunkTrust

Try the addcoltotals command.

<<your current query>>
| addcoltotals labelfield=location label="AM05"

 

---
If this reply helps you, Karma would be appreciated.
0 Karma

Muthu_Vinith
Path Finder

Is there any other ways like using eval, append commands? @richgalloway 

0 Karma

richgalloway
SplunkTrust
SplunkTrust

There's almost always more than one way to do something in SPL, but why take the hard road?

<<your current search>>
| appendpipe 
    [stats sum(cap) as cap, sum(login) as login 
    | eval location="AM05"]
---
If this reply helps you, Karma would be appreciated.
0 Karma

Muthu_Vinith
Path Finder

@richgalloway I've tried this command it works. However if I need to filter out specific locations like AB AC and AD, sum their values to a new location let's say AM05. When I search for AM05 , it should display the summed value. If i search for AB, it should show the existing value. Is it possible? 

0 Karma

richgalloway
SplunkTrust
SplunkTrust

I don't understand these new requirements.  If AB is filtered out then it cannot be searched.  You cannot search for AM05 since it doesn't exist until the appendpipe command runs.

What is the final result expected to look like?

---
If this reply helps you, Karma would be appreciated.
0 Karma

Muthu_Vinith
Path Finder

For example, I have location field containing AB, AC, AD. I need to sum these three locations and create a new location named AM05,  without replacing the existing AB, AC and AD. When searching for AM05, I want to see the added values, and when searching for AB, it should display the existing value !! @richgalloway 

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Restating the requirements does not explain them.


@Muthu_Vinith wrote:

For example, I have location field containing AB, AC, AD. I need to sum these three locations and create a new location named AM05,  without replacing the existing AB, AC and AD.

You have that.  See the following example query

 

| makeresults format=csv data="location,cap,login 
AA01,10,5
AB02,6,0
AC03,10,0"
| appendpipe 
    [stats sum(cap) as cap, sum(login) as login 
    |  eval location="AM05"]
| table location cap login

@Muthu_Vinith wrote:

When searching for AM05, I want to see the added values, and when searching for AB, it should display the existing value !!


The AM05 location doesn't exist until this search runs.  Therefore, you can't search for AM05.

 

---
If this reply helps you, Karma would be appreciated.
0 Karma

Muthu_Vinith
Path Finder

@richgalloway  Sorry I got confused. I'll say my exact requirements . In my location field there some locations
AB
AC
AD
AF
and so on. I want new one which is AM in location field where AM indicates the addition of (AB AC AD AF). 
I want to display both AB AC AD AF and AM in the location field.

Don't consider this 
AA01,10,5 

I tried something like this
|eval row=AM05
|table row location
where it will show AM05 for all fields. But i want only for addition of (AB AC AD AF) which is AM05 . without replacing existing ones that is (AB AC AD AF).

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| append [| makeresults | eval location="AM"]
0 Karma
Get Updates on the Splunk Community!

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...

Splunk AppDynamics Agents Webinar Series

Mark your calendars! On June 24th at 12PM PST, we’re going live with the second session of our Splunk ...

SplunkTrust Application Period is Officially OPEN!

It's that time, folks! The application/nomination period for the 2025 SplunkTrust is officially open! If you ...