Turn on suggestions

Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.

Showing results for

Splunk Search

Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.

Showing results for

- Community
- :
- Splunk Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- What is the best way to add a set of values in a t...

- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark
- Subscribe
- Mute
- Printer Friendly Page

Highlighted
# Type, Value

# Type, Value

- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Email to a Friend
- Report Inappropriate Content

Stevelim

Communicator

02-16-2016
12:57 AM

I have the following situation:

`some commands | table Type, Value`

which results in:

A, 5

B, 5

C, 1

D, 0

I need to add up A and B, subtract C and D, then append the result back to the table like this as another value Type="E":

A, 5

B, 5

E, 9 <- 5+5-(1+0)

Any ideas?

1 Solution

Highlighted
##
Re: What is the best way to add a set of values in a table, subtract another set of values, then append the result back to the table?

Is there any categorization available for A,B and C,D or any other field which can be used to group A,B and C,D?

- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Email to a Friend
- Report Inappropriate Content

renjith_nair

SplunkTrust

02-16-2016
01:31 AM

Highlighted

- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Email to a Friend
- Report Inappropriate Content

jplumsdaine22

Influencer

02-16-2016
02:41 AM

Appendpipe is one solution. It allows you to append to reporting commands. In this case, instead of using `table Type Value`

use `stats`

to sum the values of your types, then use `eval`

to convert C & D to negative values. Then use `appendpipe`

to get the total of your column

```
... |stats sum(Value) as Value by Type | eval Value=if((type=="C" OR type=="D"),Value*-1,Value) | appendpipe [stats sum(Value) as Value | eval Type = "E"] | search NOT (Type="C" OR Type="D")
```

You can also use addcoltotals (a simpler method, but appendpipe allows you to do more than simple sum, so it's worth knowing)

```
... |stats sum(Value) as Value by Type | eval Value=if((type=="C" OR type=="D"),Value*-1,Value) | addcoltotals Value labelfield=Type label=E | search NOT (Type="C" OR Type="D")
```

See: http://docs.splunk.com/Documentation/Splunk/6.3.3/SearchReference/Appendpipe

See: http://docs.splunk.com/Documentation/Splunk/6.3.3/SearchReference/Addcoltotals

And if you're not familar with the eval function used in these examples see: http://docs.splunk.com/Documentation/Splunk/6.3.3/SearchReference/CommonEvalFunctions

Highlighted
##
Re: What is the best way to add a set of values in a table, subtract another set of values, then append the result back to the table?

- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Email to a Friend
- Report Inappropriate Content

Stevelim

Communicator

02-16-2016
03:04 AM

Thank you! That was exactly what I was looking for!

Highlighted
##
Re: What is the best way to add a set of values in a table, subtract another set of values, then append the result back to the table?

- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Email to a Friend
- Report Inappropriate Content

javiergn

SplunkTrust

02-16-2016
02:52 AM

I tried this generic option that should work for any number of values.

I have tested it with your example and it seems to work fine:

```
| inputcsv mycsv.csv
| sort Type
| streamstats count as n
| eventstats median(n) as median
| eval ValueSign = if(median > n, Value, -Value)
| addcoltotals
| fillnull value=E
| where n < median
| fields Type, ValueSign
| rename ValueSign as Value
```