Splunk Search

Sum after every 5 rows along with column totals

ashrafsj
Path Finder

HI All,

I have situation where I need to sum every 5 rows which are for every 10 min data for an hour. so for example I need to sum the rows and columns based on 01/01/2020 00:00:00 to 00:50:00 (6 rows) and i have 5 columns in place. The hourly total should sum all the 6 rows and columns data and should be split after every 6 rows.. as shown in the below example it would be run from 00:00:00 to 23:59:59

_time                  A    B     C D   E   Hourly_Totals
2020-01-01 00:00:00 178 3   0   0   1   
2020-01-01 00:10:00 267 4   0   0   0   
2020-01-01 00:20:00 250 2   0   0   3   
2020-01-01 00:30:00 192 3   0   0   0   
2020-01-01 00:40:00 233 4   0   0   0   
2020-01-01 00:50:00 183 7   0   0   0   1330
------------------------------------------------------------------------------
2020-01-01 01:00:00 160 7   1   0   0   
2020-01-01 01:10:00 142 5   0   0   0   
2020-01-01 01:20:00 209 12  2   0   0   
2020-01-01 01:30:00 399 31  0   0   0   
2020-01-01 01:40:00 355 26  0   0   0   
2020-01-01 01:50:00 661 15  3   0   1   <Total>
Tags (2)
0 Karma

manjunathmeti
Champion

Try this:

<your base search> | addtotals fieldname=Column_Totals | eval _time=strptime(_time,"%Y-%m-%d %H") | stats sum(Column_Totals) by _time
0 Karma
Get Updates on the Splunk Community!

Index This | I’m short for "configuration file.” What am I?

May 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with a Special ...

New Articles from Academic Learning Partners, Help Expand Lantern’s Use Case Library, ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Your Guide to SPL2 at .conf24!

So, you’re headed to .conf24? You’re in for a good time. Las Vegas weather is just *chef’s kiss* beautiful in ...