Splunk Search

Adding a row that is the sum of the events for each specific time to a table

learningsplunk
Path Finder

Is this possible to transform a data set from :  

TimeUserNumber of Errors
9 pmJosh2
9 pmAndy1
10 pmJosh0
10 pmAndy1
11 pmJosh1
11 pmAndy3


to :  

TimeUserNumber of Errors
9 pmJosh2
9 pmAndy1
9 pmTotal Number of Errors3
10 pmJosh0
10 pmAndy1
10 pmTotal Number of Errors1
11 pmJosh1
11 pmAndy3
11 pmTotal Number of Errors4




I've tried to use  : 

 

<insert index here> | convert num("Number of Errors") as NumberofErrors |eval Total_Number_of_Errors= Josh + Andy |table Time User Number of Errors

 


However  its erroring out when i try to run this query .  

Labels (2)
0 Karma
1 Solution

PickleRick
SplunkTrust
SplunkTrust

Use appendpipe.

| makeresults | eval _raw="Time,User,Number
9pm,Josh,2
9pm,Andy,13
10pm,Josh,1
10pm,Andy,2
10pm,Joseph,1" | multikv noheader=f | table Time User Number
| appendpipe
[stats sum(Number) as Number by Time
| eval User="Total"]
| sort Time

Of course in order to have the "Total" row at the end of each section, you need either to name it so it's always sortable at the end or add additional field to sort by.

View solution in original post

learningsplunk
Path Finder

@PickleRick  ,  Thanks !  Thought i had to start creating 2 different charts and the combining them both using a union to get a total count for this.  The 

| appendpipe 

Splunk transforming command exactly addresses that issue. 

 

0 Karma

PickleRick
SplunkTrust
SplunkTrust

Use appendpipe.

| makeresults | eval _raw="Time,User,Number
9pm,Josh,2
9pm,Andy,13
10pm,Josh,1
10pm,Andy,2
10pm,Joseph,1" | multikv noheader=f | table Time User Number
| appendpipe
[stats sum(Number) as Number by Time
| eval User="Total"]
| sort Time

Of course in order to have the "Total" row at the end of each section, you need either to name it so it's always sortable at the end or add additional field to sort by.

Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...