Splunk Search

how to run two functions in a single query.

geetanjali
Path Finder

Hello

I have 3 guest and each guest has 10 hosts in it. i want to display data in pie chart.

my query conditions are :

Want to display sum of latest value over hosts by guest. First i need to find out latest values of host and then sum up that values guest.

My current query is:-

index="test" sourcetype="power_usage" | eval guest=ltrim(source,"/opt/app/powersupply/") | eval guest=split(guest,"/") | eval guest=mvindex(guest,-3) | chart first(Power_consumption) as a over host by guest

This query is giving latest values of hosts by guest. Next i need to sum up latest values. What would be the approach to do this. i have tried with addtotal, but it's giving result for all hosts.
How could i update my query for this.

Please help, if anybody knows the solution.

Thanks in advance.

Geetanjali

Tags (1)
0 Karma

woodcock
Esteemed Legend

Switch from chart to stats like this:

index="test" sourcetype="power_usage" | eval guest=ltrim(source,"/opt/app/powersupply/") | eval guest=split(guest,"/") | eval guest=mvindex(guest,-3) | stats first(Power_consumption) AS a BY host, guest

Then you can do this:

index="test" sourcetype="power_usage" | eval guest=ltrim(source,"/opt/app/powersupply/") | eval guest=split(guest,"/") | eval guest=mvindex(guest,-3) | stats first(Power_consumption) AS a BY host, guest | stats sum(a) by host

Or perhaps this:

index="test" sourcetype="power_usage" | eval guest=ltrim(source,"/opt/app/powersupply/") | eval guest=split(guest,"/") | eval guest=mvindex(guest,-3) | stats first(Power_consumption) AS a BY host, guest | stats sum(a) by guest
0 Karma

woodcock
Esteemed Legend

Did any of this work?

0 Karma
Get Updates on the Splunk Community!

ATTENTION!! We’re MOVING (not really)

Hey, all! In an effort to keep this Slack workspace secure and also to make our new members' experience easy, ...

Splunk Admins: Build a Smarter Stack with These Must-See .conf25 Sessions

  Whether you're running a complex Splunk deployment or just getting your bearings as a new admin, .conf25 ...

AppDynamics Summer Webinars

This summer, our mighty AppDynamics team is cooking up some delicious content on YouTube Live to satiate your ...