Splunk Search

How to add Total grouped by a field ?

zacksoft
Contributor

My table output gives me values in two columns . Column 1 gives different user name, Column 2 gives transaction time.
Column 1 contains user ids (repeated many time over differenr transactions).

I want to find what the transaction time ordered by user name.
Is it possible to achieve ?

Tags (2)
0 Karma
1 Solution

mayurr98
Super Champion

hey zacksoft
Try below query:

your_base_query | rename "Transaction Time" as transaction_time | stats sum(transaction_time) as transaction_time by User

Let me know if this helps you!

View solution in original post

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

Hi

Are you looking for like this?

YOUR_SEARCH | table User "Transaction Time" | stats sum("Transaction Time")  by User 

Thanks
Kamlesh

0 Karma

mayurr98
Super Champion

hey zacksoft
Try below query:

your_base_query | rename "Transaction Time" as transaction_time | stats sum(transaction_time) as transaction_time by User

Let me know if this helps you!

0 Karma

493669
Super Champion

Can you try below

...| table Transactiontime user|stats sum(Transactiontime) by user
0 Karma

mayurr98
Super Champion

its possible to achieve. Can you pls elaborate more on what do you want exactly by providing sample input and output values?

0 Karma

zacksoft
Contributor

User Transaction Time
Tom 15
Pean 14
Harry 12
Tom 15
Bob 11
John 19
Pean 10

Above is the sample input in tabular format.
I want to see Transaction time ordered by user.
like this
Tom 30
Penn 24
etc ....

0 Karma
Get Updates on the Splunk Community!

September Community Champions: A Shoutout to Our Contributors!

As we close the books on another fantastic month, we want to take a moment to celebrate the people who are the ...

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...