Splunk Search

How to generate a search that displays column totals per day for each email address?

rholm01
Explorer

How do I get daily totals (column) for a list of e-mail addresses (column) for registration failures?

E-mail Address     Day1    Day2   Day3   Day4   Day5   Day6   Day7   Total-Failures-for-individual
Address1           2       4                                         6
Address2           1       5                                         6
Address3           3              3                    4             10
Total Daily        6       9      3      0      0      4      0                   

replicamask
Explorer

Is there a way to have this without the values in the columns above the totals?
alt,Awesome! Is there a way to remove the values in the columns and just have the totals?
alt

0 Karma

sundareshr
Legend

Try this

base search | eval day=round(relative_time(now(), "@d")-relative_time(,_time, "@d"), 0)/86400 | eval day="Day ".day | chart count over email_id by day | addtotals | addcoltotals labelfield=email_id label="Total Daily"
Get Updates on the Splunk Community!

Stay Connected: Your Guide to January Tech Talks, Office Hours, and Webinars!

What are Community Office Hours? Community Office Hours is an interactive 60-minute Zoom series where ...

[Puzzles] Solve, Learn, Repeat: Reprocessing XML into Fixed-Length Events

This challenge was first posted on Slack #puzzles channelFor a previous puzzle, I needed a set of fixed-length ...

Data Management Digest – December 2025

Welcome to the December edition of Data Management Digest! As we continue our journey of data innovation, the ...