Splunk Search

how to add a sum in a top search?

liusf
Explorer

Hello. I have this search:

*  app="youtube" | top  limit=20 srcip by app showperc=f countfield=total

of this log:

date=2015-01-14 time=08:32:10 srcip=192.168.1.200 app="Youtube" rcvdbyte=121 
date=2015-01-14 time=08:38:10 srcip=192.168.1.200 app="Youtube" rcvdbyte=500
date=2015-01-14 time=08:32:10 srcip=192.168.1.200 app="Youtube" rcvdbyte=900

I need to add the total of bytes received (rcvdbyte) per IP in that App. I tried with stats sum before and after the top but the results are blank. Thanks

Tags (3)
1 Solution

somesoni2
SplunkTrust
SplunkTrust

Give this a try

* app="youtube" | stats sum(rcvdbyte) as rcvdbytes count as total by app,srcip | sort app, -total| streamstats count as sno by app | where sno<21 | table app srcip total rcvdbytes

View solution in original post

somesoni2
SplunkTrust
SplunkTrust

Give this a try

* app="youtube" | stats sum(rcvdbyte) as rcvdbytes count as total by app,srcip | sort app, -total| streamstats count as sno by app | where sno<21 | table app srcip total rcvdbytes

liusf
Explorer

It didn't work. rcvbytes = null

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Field name was incorrect in my search, updated it now. Check back.

0 Karma

liusf
Explorer

Thanks. It works now

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...