Splunk Search

How to add Total grouped by a field ?

zacksoft
Contributor

My table output gives me values in two columns . Column 1 gives different user name, Column 2 gives transaction time.
Column 1 contains user ids (repeated many time over differenr transactions).

I want to find what the transaction time ordered by user name.
Is it possible to achieve ?

Tags (2)
0 Karma
1 Solution

mayurr98
Super Champion

hey zacksoft
Try below query:

your_base_query | rename "Transaction Time" as transaction_time | stats sum(transaction_time) as transaction_time by User

Let me know if this helps you!

View solution in original post

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

Hi

Are you looking for like this?

YOUR_SEARCH | table User "Transaction Time" | stats sum("Transaction Time")  by User 

Thanks
Kamlesh

0 Karma

mayurr98
Super Champion

hey zacksoft
Try below query:

your_base_query | rename "Transaction Time" as transaction_time | stats sum(transaction_time) as transaction_time by User

Let me know if this helps you!

0 Karma

493669
Super Champion

Can you try below

...| table Transactiontime user|stats sum(Transactiontime) by user
0 Karma

mayurr98
Super Champion

its possible to achieve. Can you pls elaborate more on what do you want exactly by providing sample input and output values?

0 Karma

zacksoft
Contributor

User Transaction Time
Tom 15
Pean 14
Harry 12
Tom 15
Bob 11
John 19
Pean 10

Above is the sample input in tabular format.
I want to see Transaction time ordered by user.
like this
Tom 30
Penn 24
etc ....

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to January Tech Talks, Office Hours, and Webinars!

What are Community Office Hours? Community Office Hours is an interactive 60-minute Zoom series where ...

[Puzzles] Solve, Learn, Repeat: Reprocessing XML into Fixed-Length Events

This challenge was first posted on Slack #puzzles channelFor a previous puzzle, I needed a set of fixed-length ...

Data Management Digest – December 2025

Welcome to the December edition of Data Management Digest! As we continue our journey of data innovation, the ...