Splunk Search

Adding a row that is the sum of the events for each specific time to a table

learningsplunk
Path Finder

Is this possible to transform a data set from :  

TimeUserNumber of Errors
9 pmJosh2
9 pmAndy1
10 pmJosh0
10 pmAndy1
11 pmJosh1
11 pmAndy3


to :  

TimeUserNumber of Errors
9 pmJosh2
9 pmAndy1
9 pmTotal Number of Errors3
10 pmJosh0
10 pmAndy1
10 pmTotal Number of Errors1
11 pmJosh1
11 pmAndy3
11 pmTotal Number of Errors4




I've tried to use  : 

 

<insert index here> | convert num("Number of Errors") as NumberofErrors |eval Total_Number_of_Errors= Josh + Andy |table Time User Number of Errors

 


However  its erroring out when i try to run this query .  

Labels (2)
0 Karma
1 Solution

PickleRick
SplunkTrust
SplunkTrust

Use appendpipe.

| makeresults | eval _raw="Time,User,Number
9pm,Josh,2
9pm,Andy,13
10pm,Josh,1
10pm,Andy,2
10pm,Joseph,1" | multikv noheader=f | table Time User Number
| appendpipe
[stats sum(Number) as Number by Time
| eval User="Total"]
| sort Time

Of course in order to have the "Total" row at the end of each section, you need either to name it so it's always sortable at the end or add additional field to sort by.

View solution in original post

learningsplunk
Path Finder

@PickleRick  ,  Thanks !  Thought i had to start creating 2 different charts and the combining them both using a union to get a total count for this.  The 

| appendpipe 

Splunk transforming command exactly addresses that issue. 

 

0 Karma

PickleRick
SplunkTrust
SplunkTrust

Use appendpipe.

| makeresults | eval _raw="Time,User,Number
9pm,Josh,2
9pm,Andy,13
10pm,Josh,1
10pm,Andy,2
10pm,Joseph,1" | multikv noheader=f | table Time User Number
| appendpipe
[stats sum(Number) as Number by Time
| eval User="Total"]
| sort Time

Of course in order to have the "Total" row at the end of each section, you need either to name it so it's always sortable at the end or add additional field to sort by.

Get Updates on the Splunk Community!

Automatic Discovery Part 1: What is Automatic Discovery in Splunk Observability Cloud ...

If you’ve ever deployed a new database cluster, spun up a caching layer, or added a load balancer, you know it ...

Real-Time Fraud Detection: How Splunk Dashboards Protect Financial Institutions

Financial fraud isn't slowing down. If anything, it's getting more sophisticated. Account takeovers, credit ...

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...