Splunk Search

How to generate a search that displays column totals per day for each email address?

rholm01
Explorer

How do I get daily totals (column) for a list of e-mail addresses (column) for registration failures?

E-mail Address     Day1    Day2   Day3   Day4   Day5   Day6   Day7   Total-Failures-for-individual
Address1           2       4                                         6
Address2           1       5                                         6
Address3           3              3                    4             10
Total Daily        6       9      3      0      0      4      0                   

replicamask
Explorer

Is there a way to have this without the values in the columns above the totals?
alt,Awesome! Is there a way to remove the values in the columns and just have the totals?
alt

0 Karma

sundareshr
Legend

Try this

base search | eval day=round(relative_time(now(), "@d")-relative_time(,_time, "@d"), 0)/86400 | eval day="Day ".day | chart count over email_id by day | addtotals | addcoltotals labelfield=email_id label="Total Daily"
Get Updates on the Splunk Community!

Data Management Digest – November 2025

  Welcome to the inaugural edition of Data Management Digest! As your trusted partner in data innovation, the ...

Splunk Mobile: Your Brand-New Home Screen

Meet Your New Mobile Hub  Hello Splunk Community!  Staying connected to your data—no matter where you are—is ...

Introducing Value Insights (Beta): Understand the Business Impact your organization ...

Real progress on your strategic priorities starts with knowing the business outcomes your teams are delivering ...