Splunk Search

How to generate a search that will sort by a field and get aggregated data for the sorted field?

Explorer

I have a search string.

index=data sourcetype=jobs QUEUE=myqueue| dedup JOBID | FIELDS CPU_USED, USER group by USER

Each user can run multiple jobs, so I'll have duplicate USER names in the searched event. I'll also have varied CPU for each job the USER ran.

I'd like to be able to do a search that aggregates the CPUUSED by USER. So if user1 runs 2 jobs in the time period, I can get CPUUSED from the first, job, and CPU_USED from the 2nd job, added together into an aggregate (sum) value.

Could anyone assist with this?

0 Karma
1 Solution

Path Finder

You can try this to count the sum of CPU_USED for each USER

 index=data sourcetype=jobs QUEUE=myqueue| dedup JOBID | stats sum(CPU_USED) by USER

View solution in original post

Path Finder

You can try this to count the sum of CPU_USED for each USER

 index=data sourcetype=jobs QUEUE=myqueue| dedup JOBID | stats sum(CPU_USED) by USER

View solution in original post

Explorer

That worked perfectly. Thank you!

0 Karma

Splunk Employee
Splunk Employee

I belive you'll want to look here:

https://docs.splunk.com/Documentation/Splunk/6.5.0/SearchReference/Addcoltotals

With Splunk... the answer is always "YES!". It just might require more regex than you're prepared for!
0 Karma