Splunk Search

How to add a new row to my table that add the counts of three fields and subtract from another field?

avi7326
Path Finder

avi7326_0-1693411150153.png

I want to add three fields insert ,update and error then subtract it from count_carmen and add new row .

Labels (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

You could add this line if you want the total

| eval total=inserts+updates+errors

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust
| addcoltotals count_carmen inserts updates errors
| eval count_carmen=if(isnull(_time),count_carmen-inserts-updates-errors,count_carmen)
| eval inserts=if(isnull(_time),null(),inserts)
| eval updates=if(isnull(_time),null(),updates)
| eval errors=if(isnull(_time),null(),errors)
0 Karma

avi7326
Path Finder

It is giving me a new column and row  what if I only wants a column of field name difference.

avi7326_0-1693474366813.png

 

Tags (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

You literally said "add new row"!

If you just want the difference, try this

| eval difference=count_carmen-inserts-updates-errors

avi7326
Path Finder

It is giving a wrong count. I want to add the insert+update+error. Then subtract it from count_carmen.

avi7326_0-1693476792151.png

 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

You could add this line if you want the total

| eval total=inserts+updates+errors

ITWhisperer
SplunkTrust
SplunkTrust

Remove these lines (they were only required when you had the extra row (that you originally asked for)

| eval inserts=if(isnull(_time),null(),inserts)
| eval updates=if(isnull(_time),null(),updates)
| eval errors=if(isnull(_time),null(),errors)
0 Karma
Get Updates on the Splunk Community!

October Community Champions: A Shoutout to Our Contributors!

As October comes to a close, we want to take a moment to celebrate the people who make the Splunk Community ...

Community Content Calendar, November Edition

Welcome to the November edition of our Community Spotlight! Each month, we dive into the Splunk Community to ...

Stay Connected: Your Guide to November Tech Talks, Office Hours, and Webinars!

What are Community Office Hours? Community Office Hours is an interactive 60-minute Zoom series where ...