- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
avi7326
Path Finder
08-30-2023
09:03 AM
I want to add three fields insert ,update and error then subtract it from count_carmen and add new row .
1 Solution
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
ITWhisperer

SplunkTrust
08-31-2023
03:33 AM
You could add this line if you want the total
| eval total=inserts+updates+errors
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
ITWhisperer

SplunkTrust
08-30-2023
09:16 AM
| addcoltotals count_carmen inserts updates errors
| eval count_carmen=if(isnull(_time),count_carmen-inserts-updates-errors,count_carmen)
| eval inserts=if(isnull(_time),null(),inserts)
| eval updates=if(isnull(_time),null(),updates)
| eval errors=if(isnull(_time),null(),errors)
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
avi7326
Path Finder
08-31-2023
02:33 AM
It is giving me a new column and row what if I only wants a column of field name difference.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
ITWhisperer

SplunkTrust
08-31-2023
02:53 AM
You literally said "add new row"!
If you just want the difference, try this
| eval difference=count_carmen-inserts-updates-errors
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
avi7326
Path Finder
08-31-2023
03:14 AM
It is giving a wrong count. I want to add the insert+update+error. Then subtract it from count_carmen.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
ITWhisperer

SplunkTrust
08-31-2023
03:33 AM
You could add this line if you want the total
| eval total=inserts+updates+errors
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
ITWhisperer

SplunkTrust
08-31-2023
03:32 AM
Remove these lines (they were only required when you had the extra row (that you originally asked for)
| eval inserts=if(isnull(_time),null(),inserts)
| eval updates=if(isnull(_time),null(),updates)
| eval errors=if(isnull(_time),null(),errors)
