Splunk Search

How to add multiple duration from multiple independent transactions

smhsplunk
Communicator

So I am running multiple single valued transactions and putting the values in eval keywords, but I want to add all these new values to get the total value (duration1+duration2+....) and show it in another panel. Here is my following transactions I am running. They are all run separate inside a single row

index=main host=host1 | transaction startswith="keyword1" endswith="keyword1_ending" | eval keyword1_duration = duration | stats sum(keyword1_duration)
index=main host=host1 | transaction startswith="keyword2" endswith="keyword2_ending" | eval keyword2_duration = duration | stats sum(keyword2_duration)

how do I add these values ? Do I have to define a token on each block to use that value across panels ?

0 Karma
1 Solution

somesoni2
Revered Legend

If you're using Splunk 6.3 and above, something like this would work. (Update the queries accourdingly). (Run Anywhere sample)

<dashboard>
  <label>PanelsWithTokenAdd</label>
  <row>
    <panel>
      <single>
        <title>Sourcetype count</title>
        <search>
          <query>index=_internal | stats dc(sourcetype) as sourcetypes</query>
          <earliest>@d</earliest>
          <latest>now</latest>
          <done>
            <set token="sourcetypes">$result.sourcetypes$</set>
          </done>
        </search>
      </single>
    </panel>
    <panel>
      <single>
        <title>Sources</title>
        <search>
          <query>index=_internal | stats dc(source) as sources</query>
          <earliest>-60m@m</earliest>
          <latest>now</latest>
          <done>
            <set token="sources">$result.sources$</set>
          </done>
        </search>
      </single>
    </panel>
    <panel>
      <single>
        <title>Sourcetypes + Source</title>
        <search>
          <query>| gentimes start=-1 | eval sourcetypes="$sourcetypes$" | eval sources="$sources$" | eval all=sourcetypes+sources | table all</query>
          <earliest>@d</earliest>
          <latest>now</latest>
        </search>
      </single>
    </panel>
  </row>
</dashboard>

View solution in original post

somesoni2
Revered Legend

If you're using Splunk 6.3 and above, something like this would work. (Update the queries accourdingly). (Run Anywhere sample)

<dashboard>
  <label>PanelsWithTokenAdd</label>
  <row>
    <panel>
      <single>
        <title>Sourcetype count</title>
        <search>
          <query>index=_internal | stats dc(sourcetype) as sourcetypes</query>
          <earliest>@d</earliest>
          <latest>now</latest>
          <done>
            <set token="sourcetypes">$result.sourcetypes$</set>
          </done>
        </search>
      </single>
    </panel>
    <panel>
      <single>
        <title>Sources</title>
        <search>
          <query>index=_internal | stats dc(source) as sources</query>
          <earliest>-60m@m</earliest>
          <latest>now</latest>
          <done>
            <set token="sources">$result.sources$</set>
          </done>
        </search>
      </single>
    </panel>
    <panel>
      <single>
        <title>Sourcetypes + Source</title>
        <search>
          <query>| gentimes start=-1 | eval sourcetypes="$sourcetypes$" | eval sources="$sources$" | eval all=sourcetypes+sources | table all</query>
          <earliest>@d</earliest>
          <latest>now</latest>
        </search>
      </single>
    </panel>
  </row>
</dashboard>

smhsplunk
Communicator

Great this works! How do I put default value of tokens to zero ?

0 Karma

somesoni2
Revered Legend

Try replacing | eval all=sourcetypes+sources with | eval all=coalesce(sourcetypes+sources,0) in 3rd panel search.

0 Karma

sundareshr
Legend

Can an event have more than one keyword (start or end)?

0 Karma
Get Updates on the Splunk Community!

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability As businesses scale ...