Dashboards & Visualizations

Pulling Sub-Totals in a table

itsmevic
Communicator

I ingested a .CSV into Splunk which contained some patching information derived from another system. The problem with the report is that it's producing multiple rows with the same patch information. I ran it through Splunk to see if I could clean it up some by using the following query:

index=patching sourcetype=patching
| stats count by Patch_History, Patch_Number, Count
| sort -Count
| stats list(Patch_History) as Count, list(Count) by Patch_Number

This query produced the following output:

alt text

I'd like to add a subtotal for each section. I've tried using | addcolumns fieldname=" ", etc., but am not getting the desired results. Any help is appreciated!

Tags (1)
0 Karma
1 Solution

niketn
Legend

@itsmevic please try the following approach with eventstats to get the sum as Sub_Total and values() or last() or first to show only one value for Sub_Total

index=patching sourcetype=patching
| stats count by Patch_History, Patch_Number, Count
| eventstats sum(Count) as Sub_Total by Patch_Number
| sort - Count
| stats list(Patch_History) as Patch_History, list(Count) as Count, values(Sub_Total) as Sub_Total by Patch_Number
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

niketn
Legend

@itsmevic please try the following approach with eventstats to get the sum as Sub_Total and values() or last() or first to show only one value for Sub_Total

index=patching sourcetype=patching
| stats count by Patch_History, Patch_Number, Count
| eventstats sum(Count) as Sub_Total by Patch_Number
| sort - Count
| stats list(Patch_History) as Patch_History, list(Count) as Count, values(Sub_Total) as Sub_Total by Patch_Number
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

itsmevic
Communicator

Boom! Nike, you are a lifesaver! Thank you! The output is exactly what I need!

niketn
Legend

@itsmevic you were so close that I am sure you would have got it yourself after tea/coffee or may be a nap 🙂
Keep Splunking!!!

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Get Updates on the Splunk Community!

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...

Secure Your Future: Mastering Upgrade Readiness for Splunk 10

Spotlight: The Splunk Health Assistant Add-On  The Splunk Health Assistant Add-On is your ultimate companion ...

Observability Unlocked: Kubernetes & Cloud Monitoring with Splunk IM

Ready to master Kubernetes and cloud monitoring like the pros? Join Splunk’s Growth Engineering team on ...