Splunk Search

How to add Total grouped by a field ?

zacksoft
Contributor

My table output gives me values in two columns . Column 1 gives different user name, Column 2 gives transaction time.
Column 1 contains user ids (repeated many time over differenr transactions).

I want to find what the transaction time ordered by user name.
Is it possible to achieve ?

Tags (2)
0 Karma
1 Solution

mayurr98
Super Champion

hey zacksoft
Try below query:

your_base_query | rename "Transaction Time" as transaction_time | stats sum(transaction_time) as transaction_time by User

Let me know if this helps you!

View solution in original post

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

Hi

Are you looking for like this?

YOUR_SEARCH | table User "Transaction Time" | stats sum("Transaction Time")  by User 

Thanks
Kamlesh

0 Karma

mayurr98
Super Champion

hey zacksoft
Try below query:

your_base_query | rename "Transaction Time" as transaction_time | stats sum(transaction_time) as transaction_time by User

Let me know if this helps you!

0 Karma

493669
Super Champion

Can you try below

...| table Transactiontime user|stats sum(Transactiontime) by user
0 Karma

mayurr98
Super Champion

its possible to achieve. Can you pls elaborate more on what do you want exactly by providing sample input and output values?

0 Karma

zacksoft
Contributor

User Transaction Time
Tom 15
Pean 14
Harry 12
Tom 15
Bob 11
John 19
Pean 10

Above is the sample input in tabular format.
I want to see Transaction time ordered by user.
like this
Tom 30
Penn 24
etc ....

0 Karma
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...