Splunk Search

How to add a new row to my table that subtracts the counts of two fields from the count of another field?

allanmb
Engager

I have simple table as shown below

  • Msg | Count Completed Stage 1 | 975 Completed Stage 2 | 750 Hit Quit | 200

I want to be able to add a new row which takes the count of "Completed Stage 1" and subtracts the count of "Hit Quit" and subtracts the count of "Completed Stage 2" to give me another row like this:

  • Assumed Network Error | 25

How can I achieve this? I tried several combinations including this, but I can't get the result I want:

eval NetError = count("Completed Stage 1")  - count("Hit Quit") - count("Completed Stage 2")  | rename NetError as "Assumed Network Error"

Thanks

0 Karma
1 Solution

javiergn
Super Champion

Hi,

Give this a go:

your table search here
| eval temp_count = case (match(Msg, "Completed Stage 1"), Count, match(Msg, "Completed Stage 2"), -Count, match(Msg, "Hit Quit"), -Count)
| addcoltotals fieldname=temp_count
| eval Msg = coalesce(Msg, "Assumed Network Error")
| eval Count = if (match(Msg, "Assumed Network Error"), temp_count, Count)
| fields - temp_count

Regards,
Javier

View solution in original post

somesoni2
Revered Legend

Give this a try

your current search giving above table 
| appendpipe [| eval temp=1 | chart sum(Count) over temp by Msg |eval Msg="Assumed Network Error" | eval Count== 'Completed Stage 1' -'Hit Quit'-'Completed Stage 2' | table Msg Count  ]
0 Karma

allanmb
Engager

I gave this a try and it didn't work. Instead of my table I was getting a page that looked like all the events with many fields

0 Karma

javiergn
Super Champion

Hi,

Give this a go:

your table search here
| eval temp_count = case (match(Msg, "Completed Stage 1"), Count, match(Msg, "Completed Stage 2"), -Count, match(Msg, "Hit Quit"), -Count)
| addcoltotals fieldname=temp_count
| eval Msg = coalesce(Msg, "Assumed Network Error")
| eval Count = if (match(Msg, "Assumed Network Error"), temp_count, Count)
| fields - temp_count

Regards,
Javier

allanmb
Engager

Thanks I got this working nice and easily

0 Karma
Get Updates on the Splunk Community!

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...

🔐 Trust at Every Hop: How mTLS in Splunk Enterprise 10.0 Makes Security Simpler

From Idea to Implementation: Why Splunk Built mTLS into Splunk Enterprise 10.0  mTLS wasn’t just a checkbox ...