Splunk Search

Sum after every 5 rows along with column totals

ashrafsj
Path Finder

HI All,

I have situation where I need to sum every 5 rows which are for every 10 min data for an hour. so for example I need to sum the rows and columns based on 01/01/2020 00:00:00 to 00:50:00 (6 rows) and i have 5 columns in place. The hourly total should sum all the 6 rows and columns data and should be split after every 6 rows.. as shown in the below example it would be run from 00:00:00 to 23:59:59

_time                  A    B     C D   E   Hourly_Totals
2020-01-01 00:00:00 178 3   0   0   1   
2020-01-01 00:10:00 267 4   0   0   0   
2020-01-01 00:20:00 250 2   0   0   3   
2020-01-01 00:30:00 192 3   0   0   0   
2020-01-01 00:40:00 233 4   0   0   0   
2020-01-01 00:50:00 183 7   0   0   0   1330
------------------------------------------------------------------------------
2020-01-01 01:00:00 160 7   1   0   0   
2020-01-01 01:10:00 142 5   0   0   0   
2020-01-01 01:20:00 209 12  2   0   0   
2020-01-01 01:30:00 399 31  0   0   0   
2020-01-01 01:40:00 355 26  0   0   0   
2020-01-01 01:50:00 661 15  3   0   1   <Total>
Tags (2)
0 Karma

manjunathmeti
Champion

Try this:

<your base search> | addtotals fieldname=Column_Totals | eval _time=strptime(_time,"%Y-%m-%d %H") | stats sum(Column_Totals) by _time
0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

.conf25 Global Broadcast: Don’t Miss a Moment

Hello Splunkers, .conf25 is only a click away.  Not able to make it to .conf25 in person? No worries, you can ...

Observe and Secure All Apps with Splunk

 Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

What's New in Splunk Observability - August 2025

What's New We are excited to announce the latest enhancements to Splunk Observability Cloud as well as what is ...