Splunk Search

Contingency Total Rows

IRHM73
Motivator

Hi I wonder whether someone may be able to help me please.

Using an adapted solution from @woodcock I'm using the query below, I'm creating a table as follows:

Manage List
TOTAL
View Payments
TOTAL
What Do You Think
TOTAL

Then column headings "1 (HS)", "2 (HS)" etc.

index=main auditSource=frontend auditType=ExitSurvey |replace /survey With "Manage List"| contingency tags.path detail.manageList | append   [search index=main auditSource=agent-frontend auditType=ExitSurvey |replace /survey With "View Payments" |contingency tags.path detail.viewPayments ]  |append   [search index=main auditSource=frontend auditType=ExitSurvey |replace /survey With "What Do You Think" |contingency tags.path detail.whatDoYouThink] | rename tags.path TO "Question" | fields Question, 1, 2, 3, 4, 5 | fields - TOTAL | rename 1 TO "1 (HS)", 2 TO " 2 (HS)", 3 TO "3 (HS)", 4 TO "4 (HS)", 5 TO "5 (HS)"

Could someone tell me please is there a way to remove the "TOTAL" rows.

Many thanks and kind regards

Chris

0 Karma
1 Solution

sundareshr
Legend

@IRHM73 I've changed it to an answer.

Chris,

Couple of observations

1) != is a comparison operator, should be used to compare field values. In this specific instance, what you need is a boolean operator (NOT). here's some light reading on this subject http://docs.splunk.com/Documentation/Splunk/6.2.0/Search/Usethesearchcommand

2) Since you want to filter out the TOTAL row, after the contingency commands, you will have to do you search after as well. Adding something like this, before your rename command, should work

... | search tags.path!="TOTAL" 

View solution in original post

0 Karma

_jgpm_
Communicator

The auto-help on contingency told me that you add "usetotals=F" as the last option will get rid of the TOTALS row.

0 Karma

sundareshr
Legend

@IRHM73 I've changed it to an answer.

Chris,

Couple of observations

1) != is a comparison operator, should be used to compare field values. In this specific instance, what you need is a boolean operator (NOT). here's some light reading on this subject http://docs.splunk.com/Documentation/Splunk/6.2.0/Search/Usethesearchcommand

2) Since you want to filter out the TOTAL row, after the contingency commands, you will have to do you search after as well. Adding something like this, before your rename command, should work

... | search tags.path!="TOTAL" 
0 Karma

sundareshr
Legend

Try | search your_fieldname_here != "TOTAL" ?

0 Karma

IRHM73
Motivator

Hi @sundareshr, thank you for taking the time to come back to me with this.

I've tried the suggestion you kindly provided as:

index=main auditSource=frontend auditType=ExitSurvey != "TOTAL"
|replace /survey With "Manage List"
| contingency tags.path detail.manageList
| append [search index=main auditSource=frontend auditType=ExitSurvey  
|replace /survey With "View Payments" |contingency tags.path detail.viewPayments ]  
|append [search index=main auditSource=frontend auditType=ExitSurvey 
|replace /survey With "What Do You Think" 
|contingency tags.path detail.whatDoYouThink] 
| rename tags.path TO "Question" 
| fields Question, 1 2, 3, 4, 5 
| fields - TOTAL 
| rename 1 TO "1 (HS)", 2 TO " 2 (HS)", 3 TO "3 (HS)", 4 TO "4 (HS)", 5 TO "5 (HS)"

But unfortunately when I run this, I receive a 'Parser' error.

Many thanks and kind regards

Chris

0 Karma

sundareshr
Legend

Chris,

Couple of observations

1) != is a comparison operator, should be used to compare field values. In this specific instance, what you need is a boolean operator (NOT). here's some light reading on this subject http://docs.splunk.com/Documentation/Splunk/6.2.0/Search/Usethesearchcommand

2) Since you want to filter out the TOTAL row, after the contingency commands, you will have to do you search after as well. Adding something like this, before your rename command, should work

... | search tags.path!="TOTAL" 
0 Karma

IRHM73
Motivator

Hi, thank you very much for coming back to me with this. It works great! If you would like to put this as an answer I can 'Accept' it.

Thank you also for the link which I'll be studying today.

Kind Regards

Chris

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...