topic Re: How to move addtotals to the first column for a chart? in Dashboards & Visualizations

How to move addtotals to the first column for a chart?

MeMilo09 — Tue, 01 Mar 2022 20:49:43 GMT

Hello Splunk Community,

How can I move the addtotals field to display as the first column and not last for this chart?

Currently:

_time	Host123	Host456	total
2022-02-24 22:00	0	2	2

Would like:

_time	total	Host123	Host456
2022-02-24 22:00	2	0	2

Current Code:

index="Dept_data_idx" eventType="Created" status="success" host=* | bucket _time span=1h | stats count by _time host | addtotals

Re: How to move addtotals to the first column for a chart?

SanjayReddy — Wed, 02 Mar 2022 05:31:40 GMT

hi @MeMilo09

Updated Answer

you can use table command to re arrange the fields

index="Dept_data_idx" eventType="Created" status="success" host=*
| bucket _time span=1h
| stats count by _time host
| addtotals
| table Total _time host

also if you want to rename the total name which is default name use following after addtotals

fieldname="Total by Row" to rename the column name (Total is default)

Re: How to move addtotals to the first column for a chart?

MeMilo09 — Wed, 02 Mar 2022 04:34:26 GMT

Thanks, but doing | table command does not fix the issue, since I am using | chart command. When I use | table I am able to move the addtotals column to the start of the table, but it does away with the host data. So what I get now looks like this using table... notice no host name or counts are under the host now.

_time	Total	host
2022-02-24 22:00	4
2022-02-24 23:00	2

Re: How to move addtotals to the first column for a chart?

SanjayReddy — Wed, 02 Mar 2022 05:34:05 GMT

Hi @MeMilo09

I updated My initlal repsone, can you please use that query

Re: How to move addtotals to the first column for a chart?

ITWhisperer — Wed, 02 Mar 2022 09:04:56 GMT

You didn't show it as using chart, you showed using stats. For chart, use this

index="Dept_data_idx" eventType="Created" status="success" host=* | bucket _time span=1h | chart count by _time host | addtotals | table _time Total *

Re: How to move addtotals to the first column for a chart?

SanjayReddy — Wed, 02 Mar 2022 13:12:58 GMT

Hi @ITWhisperer

My bad, missed that😀

Thanks for let me know 😄

Re: How to move addtotals to the first column for a chart?

MeMilo09 — Wed, 02 Mar 2022 16:54:20 GMT

Yes, I needed to keep the chart at all costs

| table _time Total *

did it and I totally understand why now.

Thanks!