Splunk Search

How to get the Max Value and Sum for each column and put in a table?

srobinsonxtl
Path Finder

All,

I have been trying to figure this out, but running out of Ideas. I have the following data note the column names are random:

abc,def,ghi,jkl,mno 
0.992914032,0.213073702,0.935738281,0.940319131,0.181638896 
0.687276125,0.43039188,0.628441474,0.572250223,0.075034346  
0.038652134,0.553207754,0.405580043,0.61,0962327,0.11309537 
0.625120419,0.93665033,0.735556537,0.106862919,0.307562806  
0.517483329,0.977309163,0.780669733,0.941357026,0.715071147 
0.299775797,0.066687935,0.506144686,0.422054339,0.030493397 
0.616155594,0.639585224,0.021914164,0.893909265,0.885999592 
0.830145224,0.14859778,0.47885759,0.980377541,0.789053001   
0.154432947,0.25110087,0.928589057,0.946643805,0.318930878  

I would like to get the Max Value and Sum for each column and put in a table like such.

Column,Total,Max            
abc,4.761955602,0.992914032         
def,4.216604639,0.977309163         
ghi,5.421491564,0.935738281         
jkl,6.414736576,0.980377541         
mno,3.416879433,0.885999592

I would appreciate any help anyone could provide me.

Thanks,

Stephen Robinson

Tags (2)
0 Karma
1 Solution

somesoni2
Revered Legend

Try like this

YOur current search giving your dynamic fields e.g. abc,def,ghi,jkl,mno
| eval temp=1
| table temp *
| untable temp Column Value
| stats sum(Value) as Total max(Value) as Max by Column

The core of this solution is untable command. Read more about it here: http://docs.splunk.com/Documentation/Splunk/7.1.1/SearchReference/Untable

View solution in original post

somesoni2
Revered Legend

Try like this

YOur current search giving your dynamic fields e.g. abc,def,ghi,jkl,mno
| eval temp=1
| table temp *
| untable temp Column Value
| stats sum(Value) as Total max(Value) as Max by Column

The core of this solution is untable command. Read more about it here: http://docs.splunk.com/Documentation/Splunk/7.1.1/SearchReference/Untable

srobinsonxtl
Path Finder

This worked perfectly.

Thanks a million.

Thanks,

Stephen Robinson

0 Karma
Get Updates on the Splunk Community!

More Ways To Control Your Costs With Archived Metrics | Register for Tech Talk

Tuesday, May 14, 2024  |  11AM PT / 2PM ET Register to Attend Join us for this Tech Talk and learn how to ...

.conf24 | Personalize your .conf experience with Learning Paths!

Personalize your .conf24 Experience Learning paths allow you to level up your skill sets and dive deeper ...

Threat Hunting Unlocked: How to Uplevel Your Threat Hunting With the PEAK Framework ...

WATCH NOWAs AI starts tackling low level alerts, it's more critical than ever to uplevel your threat hunting ...