How to add multiple duration from multiple independent transactions

[smhsplunk]

So I am running multiple single valued transactions and putting the values in eval keywords, but I want to add all these new values to get the total value (duration1+duration2+....) and show it in another panel. Here is my following transactions I am running. They are all run separate inside a single row

index=main host=host1 | transaction startswith="keyword1" endswith="keyword1_ending" | eval keyword1_duration = duration | stats sum(keyword1_duration)
index=main host=host1 | transaction startswith="keyword2" endswith="keyword2_ending" | eval keyword2_duration = duration | stats sum(keyword2_duration)

how do I add these values ? Do I have to define a token on each block to use that value across panels ?

[somesoni2 · Accepted solution]

If you're using Splunk 6.3 and above, something like this would work. (Update the queries accourdingly). (Run Anywhere sample)

<dashboard>
  <label>PanelsWithTokenAdd</label>
  <row>
    <panel>
      <single>
        <title>Sourcetype count</title>
        <search>
          <query>index=_internal | stats dc(sourcetype) as sourcetypes</query>
          <earliest>@d</earliest>
          <latest>now</latest>
          <done>
            <set token="sourcetypes">$result.sourcetypes$</set>
          </done>
        </search>
      </single>
    </panel>
    <panel>
      <single>
        <title>Sources</title>
        <search>
          <query>index=_internal | stats dc(source) as sources</query>
          <earliest>-60m@m</earliest>
          <latest>now</latest>
          <done>
            <set token="sources">$result.sources$</set>
          </done>
        </search>
      </single>
    </panel>
    <panel>
      <single>
        <title>Sourcetypes + Source</title>
        <search>
          <query>| gentimes start=-1 | eval sourcetypes="$sourcetypes$" | eval sources="$sources$" | eval all=sourcetypes+sources | table all</query>
          <earliest>@d</earliest>
          <latest>now</latest>
        </search>
      </single>
    </panel>
  </row>
</dashboard>

[smhsplunk]

Great this works! How do I put default value of tokens to zero ?

[somesoni2]

Try replacing | eval all=sourcetypes+sources with | eval all=coalesce(sourcetypes+sources,0) in 3rd panel search.

[sundareshr]

Can an event have more than one keyword (start or end)?