Splunk Search

How to add the field values based on the criteria

kartm2020
Communicator

I want to add the in_usage and out_usage value from the below table.

for example, I want to add in_usage with out_usage and result should be as total. Likewise for other values. can someone give ideas for this.

_timesourcestatusAvgmetric_name
11/3/2021 5:02Interface_Summary_Outout_usage16.01833333GigabitEthernet0/1
11/3/2021 5:00Interface_Summary_Inin_usage5.555GigabitEthernet0/1
11/3/2021 4:02Interface_Summary_Outout_usage17.085GigabitEthernet0/1
11/3/2021 4:00Interface_Summary_Inin_usage5.270833333GigabitEthernet0/1
11/3/2021 3:02Interface_Summary_Outout_usage17.425GigabitEthernet0/1
11/3/2021 3:00Interface_Summary_Inin_usage5.48GigabitEthernet0/1

 

Please refer the attached screenshot for you reference

Labels (3)
Tags (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
| bin _time span=1h
| stats sum(Avg) as total by _time

View solution in original post

0 Karma

kartm2020
Communicator

Thank you. It worked. I have different hostname and metric_name. So i have added host and metric_name at the end

| bin _time span=1h
| stats sum(Avg) as total by _time host metric_name

 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| bin _time span=1h
| stats sum(Avg) as total by _time
0 Karma
Get Updates on the Splunk Community!

Your Guide to SPL2 at .conf24!

So, you’re headed to .conf24? You’re in for a good time. Las Vegas weather is just *chef’s kiss* beautiful in ...

Get ready to show some Splunk Certification swagger at .conf24!

Dive into the deep end of data by earning a Splunk Certification at .conf24. We're enticing you again this ...

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Now On-Demand Join us to learn more about how you can leverage Service Level Objectives (SLOs) and the new ...