Splunk Search

How to add a field that sums cash value by device_id?

Rapidz
Explorer

Currently my search query is:

sourcetype="transactions" AND (additionalMessage.requestUrl="*/cashIn/initialize" OR additionalMessage.requestUrl="*/cashIn/update" OR additionalMessage.requestUrl="*/cashIn/updateStatus" OR additionalMessage.requestUrl="*/cashIn/finalize") AND message != "Token time nonce*" message="POST - http://transactions/cashIn/finalize - RESPONSE_SENT" "additionalMessage.response.commissionPercentage"="0.15" | rename additionalMessage.requestBody.deviceId as device_id | stats count(message) as count by device_id | lookup ATMDeviceNames.csv device_id OUTPUT device_name | append [| inputlookup ATMDeviceNames.csv | table device_id device_name | eval count=0 ] | stats max(count) as count by device_id device_name | sort -count | rename count as "Completed Transactions"

it displays a statistics table like this:

device_id device_name Completed_Transactions
02f012-e0c-40d6-8ff5-2d2cba87b2 testdevice123  11


I would like to create an additional dashboard panel based on this table. I would like to swap the Completed_Transactions with a column called Total_Cash.
I can see the cash amount per transaction under the name "additionalMessage.response.fiatAmount".

I would like to see the total cash amount per device displayed, can't seem to make it work. Any help would be greatly appreciated.

Labels (3)
Tags (2)
0 Karma
1 Solution

somesoni2
Revered Legend

Try like this

sourcetype="transactions" AND (additionalMessage.requestUrl="*/cashIn/initialize" OR additionalMessage.requestUrl="*/cashIn/update" OR additionalMessage.requestUrl="*/cashIn/updateStatus" OR additionalMessage.requestUrl="*/cashIn/finalize") AND message != "Token time nonce*" message="POST - http://transactions/cashIn/finalize - RESPONSE_SENT" "additionalMessage.response.commissionPercentage"="0.15" | rename additionalMessage.requestBody.deviceId as device_id | stats count(message) as count sum(additionalMessage.response.fiatAmount) as Total_Cash by device_id | lookup ATMDeviceNames.csv device_id OUTPUT device_name | append [| inputlookup ATMDeviceNames.csv | table device_id device_name | eval count=0 , Total_Cash=0 ] | stats max(count) as count max(Total_Cash) as Total_Cash by device_id device_name | sort -count | rename count as "Completed Transactions"

View solution in original post

somesoni2
Revered Legend

Try like this

sourcetype="transactions" AND (additionalMessage.requestUrl="*/cashIn/initialize" OR additionalMessage.requestUrl="*/cashIn/update" OR additionalMessage.requestUrl="*/cashIn/updateStatus" OR additionalMessage.requestUrl="*/cashIn/finalize") AND message != "Token time nonce*" message="POST - http://transactions/cashIn/finalize - RESPONSE_SENT" "additionalMessage.response.commissionPercentage"="0.15" | rename additionalMessage.requestBody.deviceId as device_id | stats count(message) as count sum(additionalMessage.response.fiatAmount) as Total_Cash by device_id | lookup ATMDeviceNames.csv device_id OUTPUT device_name | append [| inputlookup ATMDeviceNames.csv | table device_id device_name | eval count=0 , Total_Cash=0 ] | stats max(count) as count max(Total_Cash) as Total_Cash by device_id device_name | sort -count | rename count as "Completed Transactions"
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...