Splunk Search

top with running totals

Path Finder

i have events with two fields: origin and duration

i would like to present a table with the count of each origin, along with a running total of the duration - kinda like the output of top, but with the sum of the durations of each origin as another column.

Tags (3)
0 Karma
1 Solution

Ultra Champion

Perhaps this is what you want?

... | stats sum(duration), count by origin

If not, please provide a few sample events, and a simple sketch of the desired output

/K

View solution in original post

Ultra Champion

Perhaps this is what you want?

... | stats sum(duration), count by origin

If not, please provide a few sample events, and a simple sketch of the desired output

/K

View solution in original post