Splunk Search

Extracting the values from addtotals/addcoltotals from timechart.

ronaldtanhj
Path Finder

Hi All,

I would like to extract the values from addtotals.

My current result from my search is as follows;

_timefieldafieldbfieldcfielddTotal by Day
day_112126
day_222228
day_....11114
day_n312411
Total by field7669 

 

The last lines of my search is as follows:

 

|....
|timechart span=1d sum(A) as B by C limit=0
|addtotals col=t labelfield=_time label="Total by Field" fieldname="Total by Day"

 

 

After the 'addtotals' portion, I would like to extract out the values of "Total by Field" (shown in bold and underlined) for further calculations. Or if there is an alternative method to use instead of 'addtotals'

I've tried stats sum and eval to do so but couldn't do it.

 

Anyone here able to advise on this?

 

Thanks and advance!

Labels (4)
0 Karma

kennetkline
Path Finder

If you want to see sum totals then just truncate _time (by day) drop the time:

Then do sum using stats by day;  something like this;  I put total_by_day as total record count in case you want to care it down to see; but was not a field you wanted, figured would show that.

search ...
| eval day=strftime(_time, "%Y-%m-%d")
| stats sum(fielda) as total_a, sum(fieldb) as total_b, sum(fieldc) as total_c, sum(feildd) as total_d, count as total_by_day by day
| table day total_a, total_b, total_c, total_d
| rename day as "Total by Field"

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...