Splunk Search

How to add rows in table

avi7326
Path Finder
Status UnitCount
DuplicateIT5
FailureBE2
SuccessDE6
SuccessIT25
SuccessPT18
SuccessDE10
SuccessPT5
Total 

71

 

I am adding the col total using the query
| addcoltotals label=status lable =total

But now I want to calculate the sum by Unit Like this-

After calculating the sum want to create an alert if any of the unit is 0 then it will create an alert.

IT30
DE16
PT23
BE2
  
Total71
Labels (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Try this

| stats sum(count) as total by unit

However, this will only give you totals greater than zero because there is nothing to add if there are no counts. If you want your alert to pick up on there being no values for a unit, you will have to append a row for each unit with a count of zero before this sum.

View solution in original post

avi7326
Path Finder

I want to do the total according to the status after calculating that I will check if the value is 0 for any unit It will create an alert 

| stats sum(count) as total by unit

Using this it is not giving proper results .Do I have to remove addcolumns line.

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Yes, remove the addcoltotals line or move it to after the stats, but you will need to change the column name as well.

0 Karma

avi7326
Path Finder

Getting this table after using
|stats count as count by status Unit

Status UnitCount
DuplicateIT5
FailureBE2
SuccessDE6
SuccessIT25
SuccessPT18
SuccessDE10
SuccessPT5

 But now I want it by the sum of unit according to the second table which given earlier.

| stats sum(count) as total by unit

 This is not  giving me the expected result.

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Please show what you expect the result to be

avi7326
Path Finder

I got it thanks

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Try this

| stats sum(count) as total by unit

However, this will only give you totals greater than zero because there is nothing to add if there are no counts. If you want your alert to pick up on there being no values for a unit, you will have to append a row for each unit with a count of zero before this sum.

Get Updates on the Splunk Community!

Enterprise Security (ES) Essentials 8.3 is Now GA — Smarter Detections, Faster ...

As of today, Enterprise Security (ES) Essentials 8.3 is now generally available, helping SOC teams simplify ...

AI for AppInspect

We’re excited to announce two new updates to AppInspect designed to save you time and make the app approval ...

App Platform's 2025 Year in Review: A Year of Innovation, Growth, and Community

As we step into 2026, it’s the perfect moment to reflect on what an extraordinary year 2025 was for the Splunk ...