Splunk Search

How to add a new row to my table that add the counts of three fields and subtract from another field?

avi7326
Path Finder

avi7326_0-1693411150153.png

I want to add three fields insert ,update and error then subtract it from count_carmen and add new row .

Labels (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

You could add this line if you want the total

| eval total=inserts+updates+errors

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust
| addcoltotals count_carmen inserts updates errors
| eval count_carmen=if(isnull(_time),count_carmen-inserts-updates-errors,count_carmen)
| eval inserts=if(isnull(_time),null(),inserts)
| eval updates=if(isnull(_time),null(),updates)
| eval errors=if(isnull(_time),null(),errors)
0 Karma

avi7326
Path Finder

It is giving me a new column and row  what if I only wants a column of field name difference.

avi7326_0-1693474366813.png

 

Tags (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

You literally said "add new row"!

If you just want the difference, try this

| eval difference=count_carmen-inserts-updates-errors

avi7326
Path Finder

It is giving a wrong count. I want to add the insert+update+error. Then subtract it from count_carmen.

avi7326_0-1693476792151.png

 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

You could add this line if you want the total

| eval total=inserts+updates+errors

ITWhisperer
SplunkTrust
SplunkTrust

Remove these lines (they were only required when you had the extra row (that you originally asked for)

| eval inserts=if(isnull(_time),null(),inserts)
| eval updates=if(isnull(_time),null(),updates)
| eval errors=if(isnull(_time),null(),errors)
0 Karma
Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Dynamic formatting from XML events

This challenge was first posted on Slack #puzzles channelFor a previous puzzle, I needed a set of fixed-length ...

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  🚀 Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Stronger Security with Federated Search for S3, GCP SQL & Australian Threat ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...