Splunk Search

How to add a new row to my table that add the counts of three fields and subtract from another field?

avi7326
Path Finder

avi7326_0-1693411150153.png

I want to add three fields insert ,update and error then subtract it from count_carmen and add new row .

Labels (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

You could add this line if you want the total

| eval total=inserts+updates+errors

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust
| addcoltotals count_carmen inserts updates errors
| eval count_carmen=if(isnull(_time),count_carmen-inserts-updates-errors,count_carmen)
| eval inserts=if(isnull(_time),null(),inserts)
| eval updates=if(isnull(_time),null(),updates)
| eval errors=if(isnull(_time),null(),errors)
0 Karma

avi7326
Path Finder

It is giving me a new column and row  what if I only wants a column of field name difference.

avi7326_0-1693474366813.png

 

Tags (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

You literally said "add new row"!

If you just want the difference, try this

| eval difference=count_carmen-inserts-updates-errors

avi7326
Path Finder

It is giving a wrong count. I want to add the insert+update+error. Then subtract it from count_carmen.

avi7326_0-1693476792151.png

 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

You could add this line if you want the total

| eval total=inserts+updates+errors

ITWhisperer
SplunkTrust
SplunkTrust

Remove these lines (they were only required when you had the extra row (that you originally asked for)

| eval inserts=if(isnull(_time),null(),inserts)
| eval updates=if(isnull(_time),null(),updates)
| eval errors=if(isnull(_time),null(),errors)
0 Karma
Get Updates on the Splunk Community!

Developer Spotlight with Brett Adams

In our third Spotlight feature, we're excited to shine a light on Brett—a Splunk consultant, innovative ...

Index This | What can you do to make 55,555 equal 500?

April 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Say goodbye to manually analyzing phishing and malware threats with Splunk Attack ...

In today’s evolving threat landscape, we understand you’re constantly bombarded with phishing and malware ...