<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Re: addtotals result move to the top row in Dashboards &amp; Visualizations</title>
    <link>https://community.splunk.com/t5/Dashboards-Visualizations/addtotals-result-move-to-the-top-row/m-p/683655#M55966</link>
    <description>&lt;P&gt;Thank you&lt;/P&gt;</description>
    <pubDate>Tue, 09 Apr 2024 00:00:29 GMT</pubDate>
    <dc:creator>viktoriiants</dc:creator>
    <dc:date>2024-04-09T00:00:29Z</dc:date>
    <item>
      <title>addtotals result move to the top row</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/addtotals-result-move-to-the-top-row/m-p/682441#M55869</link>
      <description>&lt;P&gt;The query produces multiple pages of results. How do I move the total to the top (first) row for convenience?&lt;/P&gt;
&lt;P&gt;&amp;nbsp;&lt;/P&gt;
&lt;LI-CODE lang="markup"&gt;search query | eval dayOfWeek=strftime(_time, "%A"), date=strftime(_time, "%Y-%m-%d") | eval dayNum=case(dayOfWeek=="Sunday", 1, dayOfWeek=="Monday", 2, dayOfWeek=="Tuesday", 3, dayOfWeek=="Wednesday", 4, dayOfWeek=="Thursday", 5, dayOfWeek=="Friday", 6, dayOfWeek=="Saturday", 7) | stats count as "Session count" by dayOfWeek, date | addtotals col=t row=f label="Month total" |sort date desc&lt;/LI-CODE&gt;
&lt;P&gt;&lt;SPAN&gt;&amp;nbsp;&lt;/SPAN&gt;&lt;/P&gt;</description>
      <pubDate>Sat, 30 Mar 2024 00:15:53 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/addtotals-result-move-to-the-top-row/m-p/682441#M55869</guid>
      <dc:creator>viktoriiants</dc:creator>
      <dc:date>2024-03-30T00:15:53Z</dc:date>
    </item>
    <item>
      <title>Re: addtotals result move to the top row</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/addtotals-result-move-to-the-top-row/m-p/682453#M55870</link>
      <description>&lt;P&gt;Hello&amp;nbsp;&lt;a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/266450"&gt;@viktoriiants&lt;/a&gt;, How about sorting it by 'Session count' before&amp;nbsp;date desc?&lt;/P&gt;</description>
      <pubDate>Sat, 30 Mar 2024 06:04:44 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/addtotals-result-move-to-the-top-row/m-p/682453#M55870</guid>
      <dc:creator>meetmshah</dc:creator>
      <dc:date>2024-03-30T06:04:44Z</dc:date>
    </item>
    <item>
      <title>Re: addtotals result move to the top row</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/addtotals-result-move-to-the-top-row/m-p/682984#M55894</link>
      <description>&lt;P&gt;Hello, Just checking through if the issue was resolved or you have any further questions?&amp;nbsp;&lt;/P&gt;</description>
      <pubDate>Wed, 03 Apr 2024 08:22:49 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/addtotals-result-move-to-the-top-row/m-p/682984#M55894</guid>
      <dc:creator>meetmshah</dc:creator>
      <dc:date>2024-04-03T08:22:49Z</dc:date>
    </item>
    <item>
      <title>Re: addtotals result move to the top row</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/addtotals-result-move-to-the-top-row/m-p/683131#M55900</link>
      <description>&lt;P&gt;Hi&amp;nbsp;&lt;a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/266450"&gt;@viktoriiants&lt;/a&gt;.,&lt;/P&gt;&lt;P&gt;How about something like this:&lt;/P&gt;&lt;LI-CODE lang="markup"&gt;index=_internal 
| eval dayOfWeek=strftime(_time, "%A"), date=strftime(_time, "%Y-%m-%d") 
| eval dayNum=tonumber(strftime(_time,"%w")) + 1 ``` 1=Sunday, ..., 7=Saturday```
| stats count as "Session count" by dayOfWeek, date 
| addtotals col=t row=f
| eval sort = if(isnull(date),1,0)
| sort - sort + date 
| fields - sort&lt;/LI-CODE&gt;&lt;P&gt;Here we're creating a new temporary field to sort on, where we set it to 1 for our total row, and 0 for all other rows. Then we sort by this column and the date column. Finally, we remove the "sort" column.&lt;/P&gt;</description>
      <pubDate>Thu, 04 Apr 2024 04:48:08 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/addtotals-result-move-to-the-top-row/m-p/683131#M55900</guid>
      <dc:creator>danspav</dc:creator>
      <dc:date>2024-04-04T04:48:08Z</dc:date>
    </item>
    <item>
      <title>Re: addtotals result move to the top row</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/addtotals-result-move-to-the-top-row/m-p/683654#M55965</link>
      <description>&lt;P&gt;Thank you! It did help&amp;nbsp;&lt;/P&gt;</description>
      <pubDate>Mon, 08 Apr 2024 23:59:34 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/addtotals-result-move-to-the-top-row/m-p/683654#M55965</guid>
      <dc:creator>viktoriiants</dc:creator>
      <dc:date>2024-04-08T23:59:34Z</dc:date>
    </item>
    <item>
      <title>Re: addtotals result move to the top row</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/addtotals-result-move-to-the-top-row/m-p/683655#M55966</link>
      <description>&lt;P&gt;Thank you&lt;/P&gt;</description>
      <pubDate>Tue, 09 Apr 2024 00:00:29 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/addtotals-result-move-to-the-top-row/m-p/683655#M55966</guid>
      <dc:creator>viktoriiants</dc:creator>
      <dc:date>2024-04-09T00:00:29Z</dc:date>
    </item>
  </channel>
</rss>

