Splunk Search

How to add multiple duration from multiple independent transactions

smhsplunk
Communicator

So I am running multiple single valued transactions and putting the values in eval keywords, but I want to add all these new values to get the total value (duration1+duration2+....) and show it in another panel. Here is my following transactions I am running. They are all run separate inside a single row

index=main host=host1 | transaction startswith="keyword1" endswith="keyword1_ending" | eval keyword1_duration = duration | stats sum(keyword1_duration)
index=main host=host1 | transaction startswith="keyword2" endswith="keyword2_ending" | eval keyword2_duration = duration | stats sum(keyword2_duration)

how do I add these values ? Do I have to define a token on each block to use that value across panels ?

0 Karma
1 Solution

somesoni2
SplunkTrust
SplunkTrust

If you're using Splunk 6.3 and above, something like this would work. (Update the queries accourdingly). (Run Anywhere sample)

<dashboard>
  <label>PanelsWithTokenAdd</label>
  <row>
    <panel>
      <single>
        <title>Sourcetype count</title>
        <search>
          <query>index=_internal | stats dc(sourcetype) as sourcetypes</query>
          <earliest>@d</earliest>
          <latest>now</latest>
          <done>
            <set token="sourcetypes">$result.sourcetypes$</set>
          </done>
        </search>
      </single>
    </panel>
    <panel>
      <single>
        <title>Sources</title>
        <search>
          <query>index=_internal | stats dc(source) as sources</query>
          <earliest>-60m@m</earliest>
          <latest>now</latest>
          <done>
            <set token="sources">$result.sources$</set>
          </done>
        </search>
      </single>
    </panel>
    <panel>
      <single>
        <title>Sourcetypes + Source</title>
        <search>
          <query>| gentimes start=-1 | eval sourcetypes="$sourcetypes$" | eval sources="$sources$" | eval all=sourcetypes+sources | table all</query>
          <earliest>@d</earliest>
          <latest>now</latest>
        </search>
      </single>
    </panel>
  </row>
</dashboard>

View solution in original post

somesoni2
SplunkTrust
SplunkTrust

If you're using Splunk 6.3 and above, something like this would work. (Update the queries accourdingly). (Run Anywhere sample)

<dashboard>
  <label>PanelsWithTokenAdd</label>
  <row>
    <panel>
      <single>
        <title>Sourcetype count</title>
        <search>
          <query>index=_internal | stats dc(sourcetype) as sourcetypes</query>
          <earliest>@d</earliest>
          <latest>now</latest>
          <done>
            <set token="sourcetypes">$result.sourcetypes$</set>
          </done>
        </search>
      </single>
    </panel>
    <panel>
      <single>
        <title>Sources</title>
        <search>
          <query>index=_internal | stats dc(source) as sources</query>
          <earliest>-60m@m</earliest>
          <latest>now</latest>
          <done>
            <set token="sources">$result.sources$</set>
          </done>
        </search>
      </single>
    </panel>
    <panel>
      <single>
        <title>Sourcetypes + Source</title>
        <search>
          <query>| gentimes start=-1 | eval sourcetypes="$sourcetypes$" | eval sources="$sources$" | eval all=sourcetypes+sources | table all</query>
          <earliest>@d</earliest>
          <latest>now</latest>
        </search>
      </single>
    </panel>
  </row>
</dashboard>

smhsplunk
Communicator

Great this works! How do I put default value of tokens to zero ?

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Try replacing | eval all=sourcetypes+sources with | eval all=coalesce(sourcetypes+sources,0) in 3rd panel search.

0 Karma

sundareshr
Legend

Can an event have more than one keyword (start or end)?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...