Splunk Search

overall sum and aggregate sum

yuming1127
Path Finder

yuming1127_1-1618371569128.png

command:

search....

| eval effort=exact(21+31+61+1103+7306+7505+15105+15106+15122)
| table tag,effort,16910,21,31,61,1103,7306,7505,15105,15106,15122

how can i get effort = sum of field in same row instead of overall sum.

expected output:

effort

4

2

2

4

4

4

Labels (3)
0 Karma

bowesmana
SplunkTrust
SplunkTrust

@yuming1127 

There's something odd in your SPL

In the eval line you are adding the following numbers together

| eval effort=exact(21+31+61+1103+7306+7505+15105+15106+15122)

so here effort evaluates to the number 61360

BUT in this statement 

| table tag,effort,16910,21,31,61,1103,7306,7505,15105,15106,15122

you are using these 'numbers' as fields and in your image they are actually field names containing only numbers.

So, the problem is that your eval statement is wrong in that it is adding up numbers not fields. In order to treat those fields as fields not numbers, you need to wrap them in single quotes, '. So your eval should be

| eval effort=('21'+'31'+'61'+'1103'+'7306'+'7505'+'15105'+'15106'+'15122')

BUT that will not give you your result for all rows, as the '21' field in row 1 in your example has no value, so will make 'effort' have no value.

You should use addtotals as @scelikok suggests and that will handle ALL fields or just the ones you specify and also handle the null value case.

 

 

 

yuming1127
Path Finder

ya, found a way to replace the null value with 0 and follow up with eval function, that worked too. Thanks!

0 Karma

scelikok
SplunkTrust
SplunkTrust

Hi @yuming1127,

You can use addtotals command;

| eval effort=exact(21+31+61+1103+7306+7505+15105+15106+15122)
| table tag,effort,16910,21,31,61,1103,7306,7505,15105,15106,15122
| addtotals

 

If this reply helps you an upvote and "Accept as Solution" is appreciated.

yuming1127
Path Finder

Great one, really appreciate your solution. Quick and easy

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud's AI Assistant in Action Series: Auditing Compliance and ...

This is the third post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...