Splunk Search
Highlighted

How to add a new row to my table that subtracts the counts of two fields from the count of another field?

Engager

I have simple table as shown below

  • Msg | Count Completed Stage 1 | 975 Completed Stage 2 | 750 Hit Quit | 200

I want to be able to add a new row which takes the count of "Completed Stage 1" and subtracts the count of "Hit Quit" and subtracts the count of "Completed Stage 2" to give me another row like this:

  • Assumed Network Error | 25

How can I achieve this? I tried several combinations including this, but I can't get the result I want:

eval NetError = count("Completed Stage 1")  - count("Hit Quit") - count("Completed Stage 2")  | rename NetError as "Assumed Network Error"

Thanks

0 Karma
Highlighted

Re: How to add a new row to my table that subtracts the counts of two fields from the count of another field?

SplunkTrust
SplunkTrust

Hi,

Give this a go:

your table search here
| eval temp_count = case (match(Msg, "Completed Stage 1"), Count, match(Msg, "Completed Stage 2"), -Count, match(Msg, "Hit Quit"), -Count)
| addcoltotals fieldname=temp_count
| eval Msg = coalesce(Msg, "Assumed Network Error")
| eval Count = if (match(Msg, "Assumed Network Error"), temp_count, Count)
| fields - temp_count

Regards,
Javier

View solution in original post

Highlighted

Re: How to add a new row to my table that subtracts the counts of two fields from the count of another field?

Engager

Thanks I got this working nice and easily

0 Karma
Highlighted

Re: How to add a new row to my table that subtracts the counts of two fields from the count of another field?

SplunkTrust
SplunkTrust

Give this a try

your current search giving above table 
| appendpipe [| eval temp=1 | chart sum(Count) over temp by Msg |eval Msg="Assumed Network Error" | eval Count== 'Completed Stage 1' -'Hit Quit'-'Completed Stage 2' | table Msg Count  ]
0 Karma
Highlighted

Re: How to add a new row to my table that subtracts the counts of two fields from the count of another field?

Engager

I gave this a try and it didn't work. Instead of my table I was getting a page that looked like all the events with many fields

0 Karma