Splunk Search

how to add a sum in a top search?

liusf
Explorer

Hello. I have this search:

*  app="youtube" | top  limit=20 srcip by app showperc=f countfield=total

of this log:

date=2015-01-14 time=08:32:10 srcip=192.168.1.200 app="Youtube" rcvdbyte=121 
date=2015-01-14 time=08:38:10 srcip=192.168.1.200 app="Youtube" rcvdbyte=500
date=2015-01-14 time=08:32:10 srcip=192.168.1.200 app="Youtube" rcvdbyte=900

I need to add the total of bytes received (rcvdbyte) per IP in that App. I tried with stats sum before and after the top but the results are blank. Thanks

Tags (3)
1 Solution

somesoni2
SplunkTrust
SplunkTrust

Give this a try

* app="youtube" | stats sum(rcvdbyte) as rcvdbytes count as total by app,srcip | sort app, -total| streamstats count as sno by app | where sno<21 | table app srcip total rcvdbytes

View solution in original post

somesoni2
SplunkTrust
SplunkTrust

Give this a try

* app="youtube" | stats sum(rcvdbyte) as rcvdbytes count as total by app,srcip | sort app, -total| streamstats count as sno by app | where sno<21 | table app srcip total rcvdbytes

liusf
Explorer

It didn't work. rcvbytes = null

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Field name was incorrect in my search, updated it now. Check back.

0 Karma

liusf
Explorer

Thanks. It works now

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...