Splunk Search

Adding a row that is the sum of the events for each specific time to a table

learningsplunk
Path Finder

Is this possible to transform a data set from :  

TimeUserNumber of Errors
9 pmJosh2
9 pmAndy1
10 pmJosh0
10 pmAndy1
11 pmJosh1
11 pmAndy3


to :  

TimeUserNumber of Errors
9 pmJosh2
9 pmAndy1
9 pmTotal Number of Errors3
10 pmJosh0
10 pmAndy1
10 pmTotal Number of Errors1
11 pmJosh1
11 pmAndy3
11 pmTotal Number of Errors4




I've tried to use  : 

 

<insert index here> | convert num("Number of Errors") as NumberofErrors |eval Total_Number_of_Errors= Josh + Andy |table Time User Number of Errors

 


However  its erroring out when i try to run this query .  

Labels (2)
0 Karma
1 Solution

PickleRick
SplunkTrust
SplunkTrust

Use appendpipe.

| makeresults | eval _raw="Time,User,Number
9pm,Josh,2
9pm,Andy,13
10pm,Josh,1
10pm,Andy,2
10pm,Joseph,1" | multikv noheader=f | table Time User Number
| appendpipe
[stats sum(Number) as Number by Time
| eval User="Total"]
| sort Time

Of course in order to have the "Total" row at the end of each section, you need either to name it so it's always sortable at the end or add additional field to sort by.

View solution in original post

learningsplunk
Path Finder

@PickleRick  ,  Thanks !  Thought i had to start creating 2 different charts and the combining them both using a union to get a total count for this.  The 

| appendpipe 

Splunk transforming command exactly addresses that issue. 

 

0 Karma

PickleRick
SplunkTrust
SplunkTrust

Use appendpipe.

| makeresults | eval _raw="Time,User,Number
9pm,Josh,2
9pm,Andy,13
10pm,Josh,1
10pm,Andy,2
10pm,Joseph,1" | multikv noheader=f | table Time User Number
| appendpipe
[stats sum(Number) as Number by Time
| eval User="Total"]
| sort Time

Of course in order to have the "Total" row at the end of each section, you need either to name it so it's always sortable at the end or add additional field to sort by.

Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...