Splunk Search

How to add the field values based on the criteria

kartm2020
Communicator

I want to add the in_usage and out_usage value from the below table.

for example, I want to add in_usage with out_usage and result should be as total. Likewise for other values. can someone give ideas for this.

_timesourcestatusAvgmetric_name
11/3/2021 5:02Interface_Summary_Outout_usage16.01833333GigabitEthernet0/1
11/3/2021 5:00Interface_Summary_Inin_usage5.555GigabitEthernet0/1
11/3/2021 4:02Interface_Summary_Outout_usage17.085GigabitEthernet0/1
11/3/2021 4:00Interface_Summary_Inin_usage5.270833333GigabitEthernet0/1
11/3/2021 3:02Interface_Summary_Outout_usage17.425GigabitEthernet0/1
11/3/2021 3:00Interface_Summary_Inin_usage5.48GigabitEthernet0/1

 

Please refer the attached screenshot for you reference

Labels (3)
Tags (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
| bin _time span=1h
| stats sum(Avg) as total by _time

View solution in original post

0 Karma

kartm2020
Communicator

Thank you. It worked. I have different hostname and metric_name. So i have added host and metric_name at the end

| bin _time span=1h
| stats sum(Avg) as total by _time host metric_name

 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| bin _time span=1h
| stats sum(Avg) as total by _time
0 Karma
Get Updates on the Splunk Community!

Index This | Why do they call it hyper text?

November 2023 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

State of Splunk Careers 2023: Career Resilience and the Continued Value of Splunk

For the past three years, Splunk has partnered with Enterprise Strategy Group to conduct a survey that gauges ...

The Great Resilience Quest: 9th Leaderboard Update

The ninth leaderboard update (11.9-11.22) for The Great Resilience Quest is out >> Kudos to all the ...