Splunk Search

How to add a new row to my table that add the counts of three fields and subtract from another field?

avi7326
Path Finder

avi7326_0-1693411150153.png

I want to add three fields insert ,update and error then subtract it from count_carmen and add new row .

Labels (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

You could add this line if you want the total

| eval total=inserts+updates+errors

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust
| addcoltotals count_carmen inserts updates errors
| eval count_carmen=if(isnull(_time),count_carmen-inserts-updates-errors,count_carmen)
| eval inserts=if(isnull(_time),null(),inserts)
| eval updates=if(isnull(_time),null(),updates)
| eval errors=if(isnull(_time),null(),errors)
0 Karma

avi7326
Path Finder

It is giving me a new column and row  what if I only wants a column of field name difference.

avi7326_0-1693474366813.png

 

Tags (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

You literally said "add new row"!

If you just want the difference, try this

| eval difference=count_carmen-inserts-updates-errors

avi7326
Path Finder

It is giving a wrong count. I want to add the insert+update+error. Then subtract it from count_carmen.

avi7326_0-1693476792151.png

 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

You could add this line if you want the total

| eval total=inserts+updates+errors

ITWhisperer
SplunkTrust
SplunkTrust

Remove these lines (they were only required when you had the extra row (that you originally asked for)

| eval inserts=if(isnull(_time),null(),inserts)
| eval updates=if(isnull(_time),null(),updates)
| eval errors=if(isnull(_time),null(),errors)
0 Karma
Get Updates on the Splunk Community!

Automatic Discovery Part 1: What is Automatic Discovery in Splunk Observability Cloud ...

If you’ve ever deployed a new database cluster, spun up a caching layer, or added a load balancer, you know it ...

Real-Time Fraud Detection: How Splunk Dashboards Protect Financial Institutions

Financial fraud isn't slowing down. If anything, it's getting more sophisticated. Account takeovers, credit ...

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...