Splunk Search

How to sum a field with a 'by' clause in pivot UI?

mjones414
Contributor

index=_internal per_sourcetype_thruput series!=splunkd | eval gb=kb/1024/1024 | timechart span=1d useother=f sum(gb) by series

So I have a created a root datamodel of index=_internal source=/opt/splunk/var/log/splunk/metrics.log*

and a child object of per_sourcetype_thruput series!=splunkd

and an eval field for gb that is kb/1024/1024

I'm getting the right fields, but for the field gb field I have no sum function with or without putting a by clause split. What do I have to do to sum a field with a by clause in pivot UI?

Tags (4)
0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Make sure you set the type of that field to Number rather than String.

0 Karma
Get Updates on the Splunk Community!

Aligning Observability Costs with Business Value: Practical Strategies

 Join us for an engaging Tech Talk on Aligning Observability Costs with Business Value: Practical ...

Mastering Data Pipelines: Unlocking Value with Splunk

 In today's AI-driven world, organizations must balance the challenges of managing the explosion of data with ...

Splunk Up Your Game: Why It's Time to Embrace Python 3.9+ and OpenSSL 3.0

Did you know that for Splunk Enterprise 9.4, Python 3.9 is the default interpreter? This shift is not just a ...