Splunk Search

How to run two function in single query?

geetanjali
Path Finder

hi,

I want to display sum of latest values in "SingleValue" module. what would be my query?
i am using :-

<module name="HiddenSearch" layoutPanel="panel_row2_col1" autoRun="True">
    <param name="search">index="test" sourcetype="power_usage" | chart sum(Power_consumption) as Total(W)  </param>
          <module name="SingleValue">
            <param name="beforeLabel">現在の消費電力: </param>
            <param name="format">results</param>
            <param name="afterLabel">(W)</param>
          </module>
    </module> 

This module will return over all sum of power consumption. I want to sum only latest values.

like : sum(first(Power_consumption))

How could i update my query?

Please help.

thanks in advance

Tags (1)
0 Karma

hjwang
Contributor

The last function just only return last seen value of your specified field. Or you wanna sum(Power_consumption) during the specified time period, if so, you can add earliest=-1h latest=now in your search string.

0 Karma
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...