Splunk Search

How is it possible to assign the result of the | append [ subsearch ] in a constant?

skender27
Contributor

Hi,

I have a search and an | append [subsearch] which adds at the bottom of the results (see image) a new row with the sum of the values per every column.
Is there a way to assign those results (see 1317 in the image provided) in a constant or a field (through an eval maybe)?

alt text

Thanks,
Skender

0 Karma

woodcock
Esteemed Legend

If you are saying to give the last row a name for the leading field without knowing the name of the field/column, you can do this will fillnull like this:

... | fillnull value="Total"
0 Karma

somesoni2
Revered Legend

Are you looking to add a new field (in your main search result) which will have sum of values of a column (which you're adding through an append subsearch? If yes then try this

your main search  | eventstats sum(field1) as TotalField1
0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...