Splunk Search

How to add a new row to my table that add the counts of three fields and subtract from another field?

avi7326
Path Finder

avi7326_0-1693411150153.png

I want to add three fields insert ,update and error then subtract it from count_carmen and add new row .

Labels (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

You could add this line if you want the total

| eval total=inserts+updates+errors

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust
| addcoltotals count_carmen inserts updates errors
| eval count_carmen=if(isnull(_time),count_carmen-inserts-updates-errors,count_carmen)
| eval inserts=if(isnull(_time),null(),inserts)
| eval updates=if(isnull(_time),null(),updates)
| eval errors=if(isnull(_time),null(),errors)
0 Karma

avi7326
Path Finder

It is giving me a new column and row  what if I only wants a column of field name difference.

avi7326_0-1693474366813.png

 

Tags (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

You literally said "add new row"!

If you just want the difference, try this

| eval difference=count_carmen-inserts-updates-errors

avi7326
Path Finder

It is giving a wrong count. I want to add the insert+update+error. Then subtract it from count_carmen.

avi7326_0-1693476792151.png

 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

You could add this line if you want the total

| eval total=inserts+updates+errors

ITWhisperer
SplunkTrust
SplunkTrust

Remove these lines (they were only required when you had the extra row (that you originally asked for)

| eval inserts=if(isnull(_time),null(),inserts)
| eval updates=if(isnull(_time),null(),updates)
| eval errors=if(isnull(_time),null(),errors)
0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars this month. This ...

They're back! Join the SplunkTrust and MVP at .conf24

With our highly anticipated annual conference, .conf, comes the fez-wearers you can trust! The SplunkTrust, as ...

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...