Splunk Search

appending statistics to same table cell

tmarlette
Motivator

I have a search that is a series of multikv fields for Linux. this is leveraging the sourcetype=interfaces in the default Unix app.

I am attempting to attach a 'total throughput' field to the back of each NIC in parenthesis. I've seen this done before, but I can't remember how to do this, so any help would be appreciated. I am using stats values() as it keeps everything very neat, and keeping this clean is my goal.

This is my search currently:

index=myIndex sourcetype=interfaces | eval total=(RXbytes + TXbytes)/1024/1024/1024 | eval errors=(TXerrors + RXerrors)  | where total>0 | stats values(Name) as NIC sum(total) as total by host

This gives me a result that looks like this:
alt text

You'll notice that there is only a single 'sum' on each host, and i'm looking to append the 'total' field, per NIC, per host in parenthesis to the NIC.

If that's not possible, then a single total per NIC per host would be great as well, but not using the 'table' command, or something generic. That's too messy with hundreds of hosts, and up to 10 NIC's a piece, so I'm looking for something cleaner.

Any suggestions are appreciated, Thank you!!

Tags (3)
0 Karma
1 Solution

tmarlette
Motivator

I just decided to build my own field for this, and add the relevant information.

This is my final search:

  index=myIndexsourcetype=interfaces 
    | eval total=(RXbytes + TXbytes)/1024/1024/1024 
    | eval error=(TXerrors + RXerrors)  
    | where total>0 
    | bucket _time span=5m
    | stats latest(total) as GB latest(error) as errors by Name hostname 
    | eval total=round(GB,2) 
    | eval combine=("NIC: " + Name." --- ". GB +" GB"." --- ". errors + " errors")
    | stats values(combine) as totalsByNIC by hostname

And this is the final visualization:

alt text

View solution in original post

0 Karma

tmarlette
Motivator

I just decided to build my own field for this, and add the relevant information.

This is my final search:

  index=myIndexsourcetype=interfaces 
    | eval total=(RXbytes + TXbytes)/1024/1024/1024 
    | eval error=(TXerrors + RXerrors)  
    | where total>0 
    | bucket _time span=5m
    | stats latest(total) as GB latest(error) as errors by Name hostname 
    | eval total=round(GB,2) 
    | eval combine=("NIC: " + Name." --- ". GB +" GB"." --- ". errors + " errors")
    | stats values(combine) as totalsByNIC by hostname

And this is the final visualization:

alt text

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Perhaps ... | stats sum(total) as total by host,Name ?

---
If this reply helps you, Karma would be appreciated.
0 Karma

tmarlette
Motivator

Negatory my friend. This gets me a sum within a table. Thank you though!

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...