Splunk Search

Stats - a number of different stats but only one by date_month

timmoammo
New Member

Hello,

I'm trying to report a number of different stats however only one of the stats needs to be by month. All of the other stats are sum/avg/max for the whole period. If I add "by date_month" to the end of the search it appears to complete each of the stats by month.

Is there any way to separate the one stats component from the rest?

stats sum(UAFG_Adjusted_Energy___GJ) as Consumption_Adjusted_for_UAFG 
sum(Energy___GJ) as Consumption_Without_UAFG
avg(gsa_energy_charge) as Commodity_Average_Rate
sum(Commodity) as Commodity_Total
avg(vic_mkt_energy_safe_vic_charge) as ESV_Average_Rate
max(Energy_Safe_VIC) as ESV_max
max(cud_mthly_metering) by date_month

Many thanks

Tags (1)
0 Karma

HiroshiSatoh
Champion

Do not be resolved by "appendcols"?

search *|stats sum(a)・・・・・・|appendcols [search *|stats sum(x) by month]

0 Karma

HiroshiSatoh
Champion

I am glad if there is no problem as the answer, and enjoy it by clicking the check to the left of the answer.

0 Karma

timmoammo
New Member

Thanks for your answer. I can see how this would work however I've found a different solution by adjusting the search upstream of the stats. Thanks

0 Karma
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...