Contingency Total Rows

[IRHM73]

Hi I wonder whether someone may be able to help me please.

Using an adapted solution from @woodcock I'm using the query below, I'm creating a table as follows:

Manage List
TOTAL
View Payments
TOTAL
What Do You Think
TOTAL

Then column headings "1 (HS)", "2 (HS)" etc.

index=main auditSource=frontend auditType=ExitSurvey |replace /survey With "Manage List"| contingency tags.path detail.manageList | append   [search index=main auditSource=agent-frontend auditType=ExitSurvey |replace /survey With "View Payments" |contingency tags.path detail.viewPayments ]  |append   [search index=main auditSource=frontend auditType=ExitSurvey |replace /survey With "What Do You Think" |contingency tags.path detail.whatDoYouThink] | rename tags.path TO "Question" | fields Question, 1, 2, 3, 4, 5 | fields - TOTAL | rename 1 TO "1 (HS)", 2 TO " 2 (HS)", 3 TO "3 (HS)", 4 TO "4 (HS)", 5 TO "5 (HS)"

Could someone tell me please is there a way to remove the "TOTAL" rows.

Many thanks and kind regards

Chris

[_jgpm_]

The auto-help on contingency told me that you add "usetotals=F" as the last option will get rid of the TOTALS row.

[sundareshr · Accepted solution]

@IRHM73 I've changed it to an answer.

Chris,

Couple of observations

1) != is a comparison operator, should be used to compare field values. In this specific instance, what you need is a boolean operator (NOT). here's some light reading on this subject http://docs.splunk.com/Documentation/Splunk/6.2.0/Search/Usethesearchcommand

2) Since you want to filter out the TOTAL row, after the contingency commands, you will have to do you search after as well. Adding something like this, before your rename command, should work

... | search tags.path!="TOTAL" 

[sundareshr]

Try | search your_fieldname_here != "TOTAL" ?

[IRHM73]

Hi @sundareshr, thank you for taking the time to come back to me with this.

I've tried the suggestion you kindly provided as:

index=main auditSource=frontend auditType=ExitSurvey != "TOTAL"
|replace /survey With "Manage List"
| contingency tags.path detail.manageList
| append [search index=main auditSource=frontend auditType=ExitSurvey  
|replace /survey With "View Payments" |contingency tags.path detail.viewPayments ]  
|append [search index=main auditSource=frontend auditType=ExitSurvey 
|replace /survey With "What Do You Think" 
|contingency tags.path detail.whatDoYouThink] 
| rename tags.path TO "Question" 
| fields Question, 1 2, 3, 4, 5 
| fields - TOTAL 
| rename 1 TO "1 (HS)", 2 TO " 2 (HS)", 3 TO "3 (HS)", 4 TO "4 (HS)", 5 TO "5 (HS)"

But unfortunately when I run this, I receive a 'Parser' error.

Many thanks and kind regards

Chris

[sundareshr]

Chris,

Couple of observations

1) != is a comparison operator, should be used to compare field values. In this specific instance, what you need is a boolean operator (NOT). here's some light reading on this subject http://docs.splunk.com/Documentation/Splunk/6.2.0/Search/Usethesearchcommand

2) Since you want to filter out the TOTAL row, after the contingency commands, you will have to do you search after as well. Adding something like this, before your rename command, should work

... | search tags.path!="TOTAL" 

[IRHM73]

Hi, thank you very much for coming back to me with this. It works great! If you would like to put this as an answer I can 'Accept' it.

Thank you also for the link which I'll be studying today.

Kind Regards

Chris