Splunk Search

How to add rows in table

avi7326
Path Finder
Status UnitCount
DuplicateIT5
FailureBE2
SuccessDE6
SuccessIT25
SuccessPT18
SuccessDE10
SuccessPT5
Total 

71

 

I am adding the col total using the query
| addcoltotals label=status lable =total

But now I want to calculate the sum by Unit Like this-

After calculating the sum want to create an alert if any of the unit is 0 then it will create an alert.

IT30
DE16
PT23
BE2
  
Total71
Labels (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Try this

| stats sum(count) as total by unit

However, this will only give you totals greater than zero because there is nothing to add if there are no counts. If you want your alert to pick up on there being no values for a unit, you will have to append a row for each unit with a count of zero before this sum.

View solution in original post

avi7326
Path Finder

I want to do the total according to the status after calculating that I will check if the value is 0 for any unit It will create an alert 

| stats sum(count) as total by unit

Using this it is not giving proper results .Do I have to remove addcolumns line.

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Yes, remove the addcoltotals line or move it to after the stats, but you will need to change the column name as well.

0 Karma

avi7326
Path Finder

Getting this table after using
|stats count as count by status Unit

Status UnitCount
DuplicateIT5
FailureBE2
SuccessDE6
SuccessIT25
SuccessPT18
SuccessDE10
SuccessPT5

 But now I want it by the sum of unit according to the second table which given earlier.

| stats sum(count) as total by unit

 This is not  giving me the expected result.

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Please show what you expect the result to be

avi7326
Path Finder

I got it thanks

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Try this

| stats sum(count) as total by unit

However, this will only give you totals greater than zero because there is nothing to add if there are no counts. If you want your alert to pick up on there being no values for a unit, you will have to append a row for each unit with a count of zero before this sum.

Get Updates on the Splunk Community!

Observability | Use Synthetic Monitoring for Website Metadata Verification

If you are on Splunk Observability Cloud, you may already have Synthetic Monitoringin your observability ...

More Ways To Control Your Costs With Archived Metrics | Register for Tech Talk

Tuesday, May 14, 2024  |  11AM PT / 2PM ET Register to Attend Join us for this Tech Talk and learn how to ...

.conf24 | Personalize your .conf experience with Learning Paths!

Personalize your .conf24 Experience Learning paths allow you to level up your skill sets and dive deeper ...