Splunk Search

List sum of fields across events

twinspop
Influencer

This seems like it would be easy. Maybe it is, and I'm being thick today. 😕

Log lines look like

... server1 qs_queue1=50 qs_queue3=60 qs_queue10=100
... server2 qs_queue4=50 qs_queue6=10 qs_queue10=150
... server3 qs_queue1=20 qs_queue4=70 qs_queue3=150

I want to create a chart that will list each distinct qs_* field in rows with the sum of all values for that particular qs_ field in the searched time frame listed next to it:

qs_queue10    250
qs_queue1     70
qs_queue4     120

... etc.

The chart command

... | chart sum(qs_*)

charts in the wrong orientation in 2 rows, with the qs_ fields along the top row, and their values in the 2nd row. Same data being displayed, but in a far less presentable way.

TIA, jon

1 Solution

gkanapathy
Splunk Employee
Splunk Employee
... | stats sum(qs_*) | transpose

should do it.

View solution in original post

gkanapathy
Splunk Employee
Splunk Employee
... | stats sum(qs_*) | transpose

should do it.

twinspop
Influencer

Crikey, should have found that. Thanks!

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...