Splunk Search

How to get Total Sum of Error Type Counts per day?

mhamano
Explorer

I'm trying to add a column to the right of OTHER, which sums up the entire row counts of each errorType per day. So for example, the first value in a column farthest to the right would be the total count for api_error + approved + declined + expired_Card etc. for each day.

My current search is gateway=firstdata errorType!=null event=transactionCompleted | timechart count by errorType span="1m"

alt text

0 Karma

somesoni2
Revered Legend

Look at the addtotals command.

My current search is gateway=firstdata errorType!=null event=transactionCompleted | timechart count by errorType span="1m" | addtotals 

http://docs.splunk.com/Documentation/Splunk/6.3.3/SearchReference/Addtotals

Get Updates on the Splunk Community!

Splunk Lantern | Spotlight on Security: Adoption Motions, War Stories, and More

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

Splunk Cloud | Empowering Splunk Administrators with Admin Config Service (ACS)

Greetings, Splunk Cloud Admins and Splunk enthusiasts! The Admin Configuration Service (ACS) team is excited ...

Tech Talk | One Log to Rule Them All

One log to rule them all: how you can centralize your troubleshooting with Splunk logs We know how important ...