https://community.splunk.com/t5/Splunk-Search/Is-there-a-way-to-get-addcoltotals-to-show-up-at-the-top-of-a/m-p/339565#M100697 <P>@jbezanson...If addcoltotals is showing results in the end just add the following in the end <CODE>| reverse</CODE>. PS: If you are not sowing more than 10000 results then you can use sort as well. However, I would expect reverse to perform better.</P> Thu, 20 Apr 2017 07:27:55 GMT niketn 2017-04-20T07:27:55Z https://community.splunk.com/t5/Splunk-Search/Is-there-a-way-to-get-addcoltotals-to-show-up-at-the-top-of-a/m-p/339562#M100694 <P>I have a report that reports the count of events per another field. I can get a total of all of these events but it shows up at the bottom.<BR /> Can I get that total from "addcoltotals" to show up at the very top instead?</P> Wed, 19 Apr 2017 22:55:57 GMT https://community.splunk.com/t5/Splunk-Search/Is-there-a-way-to-get-addcoltotals-to-show-up-at-the-top-of-a/m-p/339562#M100694 jbezanson 2017-04-19T22:55:57Z https://community.splunk.com/t5/Splunk-Search/Is-there-a-way-to-get-addcoltotals-to-show-up-at-the-top-of-a/m-p/339563#M100695 <P>You could put a <CODE>| sort fieldA fieldB</CODE> etc at the end of your SPL. You will just need to figure out which fields to use for the sort to make the order come out the way you want...</P> Thu, 20 Apr 2017 00:50:24 GMT https://community.splunk.com/t5/Splunk-Search/Is-there-a-way-to-get-addcoltotals-to-show-up-at-the-top-of-a/m-p/339563#M100695 lguinn2 2017-04-20T00:50:24Z https://community.splunk.com/t5/Splunk-Search/Is-there-a-way-to-get-addcoltotals-to-show-up-at-the-top-of-a/m-p/339564#M100696 <P>use sort option</P> Thu, 20 Apr 2017 03:46:50 GMT https://community.splunk.com/t5/Splunk-Search/Is-there-a-way-to-get-addcoltotals-to-show-up-at-the-top-of-a/m-p/339564#M100696 puneethgowda 2017-04-20T03:46:50Z https://community.splunk.com/t5/Splunk-Search/Is-there-a-way-to-get-addcoltotals-to-show-up-at-the-top-of-a/m-p/339565#M100697 <P>@jbezanson...If addcoltotals is showing results in the end just add the following in the end <CODE>| reverse</CODE>. PS: If you are not sowing more than 10000 results then you can use sort as well. However, I would expect reverse to perform better.</P> Thu, 20 Apr 2017 07:27:55 GMT https://community.splunk.com/t5/Splunk-Search/Is-there-a-way-to-get-addcoltotals-to-show-up-at-the-top-of-a/m-p/339565#M100697 niketn 2017-04-20T07:27:55Z https://community.splunk.com/t5/Splunk-Search/Is-there-a-way-to-get-addcoltotals-to-show-up-at-the-top-of-a/m-p/339566#M100698 <P>One way to do this is to click the column name and it will bring it to the top, it will also sort the chart by highest to lowest. e.g. you couldn't have the column total at the top and have the lowest value below it. </P> <P><span class="lia-inline-image-display-wrapper" image-alt="alt text"><img src="https://community.splunk.com/t5/image/serverpage/image-id/2806iC654D7CFDC167280/image-size/large?v=v2&amp;px=999" role="button" title="alt text" alt="alt text" /></span></P> Thu, 22 Feb 2018 06:27:47 GMT https://community.splunk.com/t5/Splunk-Search/Is-there-a-way-to-get-addcoltotals-to-show-up-at-the-top-of-a/m-p/339566#M100698 ElijahLynn 2018-02-22T06:27:47Z https://community.splunk.com/t5/Splunk-Search/Is-there-a-way-to-get-addcoltotals-to-show-up-at-the-top-of-a/m-p/339567#M100699 <P>Add the |sort - count after the |addcoltotals. It will sort your count by greatest to least. </P> <PRE><CODE>{your search} | addcoltotals | sort - count </CODE></PRE> Tue, 09 Jul 2019 21:28:30 GMT https://community.splunk.com/t5/Splunk-Search/Is-there-a-way-to-get-addcoltotals-to-show-up-at-the-top-of-a/m-p/339567#M100699 jbillings 2019-07-09T21:28:30Z