Splunk Search

How to edit my search to add subtotals for successful events by _time for every error?

shivarpith
Path Finder

What I have:

Time                   User        count     Error
2016-02-04 04:18:00 cinci     1  
2016-02-04 04:18:01 cfl
                       tampabay    2     
2016-02-04 04:18:03 nc        4  
2016-02-04 04:18:04             1         1 

What I need:

Time                   User        count      Error
2016-02-04 04:18:00 cinci     1  
2016-02-04 04:18:01 cfl
                       tampabay    2     
2016-02-04 04:18:03 nc        4  
Total users                        7
2016-02-04 04:18:04             1          1
Time                   User        count      Error
2016-02-04 04:18:08 cinci     2
2016-02-04 04:18:10 cfl
                       tampabay    2     
2016-02-04 04:18:13 nc        4  
Total users                        8
....
...
...

..... so before every error, it has to give the total successful event counts based on user and timestamp.

My search:

index=prod user=* 
| fields user,_time
| stats count by user,_time 
| stats values(user) as Domain,sum(count) as Total by _time
| append [ search index=prod error="xyz"
| stats count by error,_time
| stats count(error) as Error,sum(count) as Total by _time]
| sort _time
0 Karma

somesoni2
SplunkTrust
SplunkTrust

Try something like this

index=prod user=* 
 | fields user,_time
 | stats count by user,_time 
 | stats values(user) as Domain,sum(count) as Total by _time
 | append [ search index=prod error="xyz"
 | stats count by error,_time
 | stats count(error) as Error,sum(count) as Total by _time]
 | sort _time
 | eval temp=Error | fillnull temp value=0
 | accum temp | appendpipe [| stats max(_time) as _time sum(Total) as Total by  temp | eval Domain="***************Total Users"]
 | sort _time temp | fields - temp
0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...