Splunk Search

How to add rows in table

avi7326
Path Finder
Status UnitCount
DuplicateIT5
FailureBE2
SuccessDE6
SuccessIT25
SuccessPT18
SuccessDE10
SuccessPT5
Total 

71

 

I am adding the col total using the query
| addcoltotals label=status lable =total

But now I want to calculate the sum by Unit Like this-

After calculating the sum want to create an alert if any of the unit is 0 then it will create an alert.

IT30
DE16
PT23
BE2
  
Total71
Labels (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Try this

| stats sum(count) as total by unit

However, this will only give you totals greater than zero because there is nothing to add if there are no counts. If you want your alert to pick up on there being no values for a unit, you will have to append a row for each unit with a count of zero before this sum.

View solution in original post

avi7326
Path Finder

I want to do the total according to the status after calculating that I will check if the value is 0 for any unit It will create an alert 

| stats sum(count) as total by unit

Using this it is not giving proper results .Do I have to remove addcolumns line.

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Yes, remove the addcoltotals line or move it to after the stats, but you will need to change the column name as well.

0 Karma

avi7326
Path Finder

Getting this table after using
|stats count as count by status Unit

Status UnitCount
DuplicateIT5
FailureBE2
SuccessDE6
SuccessIT25
SuccessPT18
SuccessDE10
SuccessPT5

 But now I want it by the sum of unit according to the second table which given earlier.

| stats sum(count) as total by unit

 This is not  giving me the expected result.

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Please show what you expect the result to be

avi7326
Path Finder

I got it thanks

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Try this

| stats sum(count) as total by unit

However, this will only give you totals greater than zero because there is nothing to add if there are no counts. If you want your alert to pick up on there being no values for a unit, you will have to append a row for each unit with a count of zero before this sum.

Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Defend at Machine Speed: Your Guide to Security Sessions at .conf26

Splunk .conf26   With threats moving at machine speed and attack surfaces expanding across hybrid ...

Where Innovation Takes Flight: The Splunk4Aviation Flight Sim Lands at .conf26

If you hear someone at .conf26 shouting "gear down, GEAR DOWN" across the show floor, you have found us.  The ...

Turn Cisco Telemetry Into Action with Cisco Data Fabric, powered by the Splunk ...

The surge in machine data is already hitting enterprise budgets, and the agentic era will only intensify it. ...