How can I modify the search to show only the host_name and the sum total of the avg_kWh column?

[mallaht]

I have borrowed a search from an earlier question to help give kWh information on a given month. How can I modify the search to show only the host_name and the sum total of the avg_kWh column?

index=network sourcetype=zabbix metric_name="st4InputCordActivePower" host_name="pdu02.LON5.Contoso.com"
| bin _time span=1h
| stats count as samples sum(value) as watt_sum by _time
| eval kW_Sum=watt_sum/1000
| eval avg_kWh=kW_Sum/samples
| addcoltotals

2022-05-30 18:00	12	44335.0	3.69458	44.3350
....
2022-05-31 23:00	12	43489.0	3.62408	43.4890
	7686	27425688.0	2595.96346	27425.6880

[gcusello]

Hi @mallaht,

please try something like this:

index=network sourcetype=zabbix metric_name="st4InputCordActivePower" host_name="pdu02.LON5.Contoso.com"
| stats count sum(value) as watt_sum by host
| eval kW_Sum=watt_sum/1000
| eval avg_kWh=kW_Sum/count
| tables host kW_Sum avg_kWh
| addcoltotals

If you ahve problems to modify this search I hint to follow the Splunk Search Tutorial (https://docs.splunk.com/Documentation/SplunkCloud/8.2.2203/SearchTutorial/WelcometotheSearchTutorial)

Ciao.

Giuseppe

[mallaht]

Thanks, I'll give the documentation a read.

I've changed the search to now return a single value but I can not get it to show the PDU name in the results is returns a empty field

[mallaht]

index=network sourcetype=databus_zenoss metric_name="st4InputCordActivePower" host_name="pdu02r102-cprod.euw11.gi-nw.viasat.io"
| bin _time span=1h
| stats count as samples sum(value) as watt_sum by _time
| eval avg_kWh=(watt_sum/1000)/samples
| eval PDU=host_name
| eventstats sum(avg_kWh) as total
| dedup total
| table PDU total