Splunk Search

Adding a row that is the sum of the events for each specific time to a table

learningsplunk
Path Finder

Is this possible to transform a data set from :  

TimeUserNumber of Errors
9 pmJosh2
9 pmAndy1
10 pmJosh0
10 pmAndy1
11 pmJosh1
11 pmAndy3


to :  

TimeUserNumber of Errors
9 pmJosh2
9 pmAndy1
9 pmTotal Number of Errors3
10 pmJosh0
10 pmAndy1
10 pmTotal Number of Errors1
11 pmJosh1
11 pmAndy3
11 pmTotal Number of Errors4




I've tried to use  : 

 

<insert index here> | convert num("Number of Errors") as NumberofErrors |eval Total_Number_of_Errors= Josh + Andy |table Time User Number of Errors

 


However  its erroring out when i try to run this query .  

Labels (2)
0 Karma
1 Solution

PickleRick
SplunkTrust
SplunkTrust

Use appendpipe.

| makeresults | eval _raw="Time,User,Number
9pm,Josh,2
9pm,Andy,13
10pm,Josh,1
10pm,Andy,2
10pm,Joseph,1" | multikv noheader=f | table Time User Number
| appendpipe
[stats sum(Number) as Number by Time
| eval User="Total"]
| sort Time

Of course in order to have the "Total" row at the end of each section, you need either to name it so it's always sortable at the end or add additional field to sort by.

View solution in original post

learningsplunk
Path Finder

@PickleRick  ,  Thanks !  Thought i had to start creating 2 different charts and the combining them both using a union to get a total count for this.  The 

| appendpipe 

Splunk transforming command exactly addresses that issue. 

 

0 Karma

PickleRick
SplunkTrust
SplunkTrust

Use appendpipe.

| makeresults | eval _raw="Time,User,Number
9pm,Josh,2
9pm,Andy,13
10pm,Josh,1
10pm,Andy,2
10pm,Joseph,1" | multikv noheader=f | table Time User Number
| appendpipe
[stats sum(Number) as Number by Time
| eval User="Total"]
| sort Time

Of course in order to have the "Total" row at the end of each section, you need either to name it so it's always sortable at the end or add additional field to sort by.

Get Updates on the Splunk Community!

Splunk Enterprise Security 8.x: The Essential Upgrade for Threat Detection, ...

 Prepare to elevate your security operations with the powerful upgrade to Splunk Enterprise Security 8.x! This ...

Get Early Access to AI Playbook Authoring: Apply for the Alpha Private Preview ...

Passionate about security automation? Apply now to our AI Playbook Authoring Alpha private preview ...

Reduce and Transform Your Firewall Data with Splunk Data Management

Managing high-volume firewall data has always been a challenge. Noisy events and verbose traffic logs often ...