topic Re: How do you create a total column in a chart? in Splunk Search

How do you create a total column in a chart?

barrowvian — Mon, 17 Sep 2018 13:52:37 GMT

Hi,

I'm pretty new to Splunk and have been playing around with it.

index=sse_cae_summary_idx new_sourcetype=sse_altair_log_summary_stype 
| search FEATURE_NAME="HWHyperMesh*"  FEATURE_VERSION="9.0" 
| eval DurationHour=DURATION/3600 
| chart dc(USER_NAME) as "Unique Users" by USER_NAME

The above code simply gives me each unique user that is using version 9 of Hypermesh. The chart has two columns, username and unique users. The unique users column has a 1 in for each of the users . Ideally, I'd rather have a total column that just details the amount of unique users that are in the search. Please could someone help me out? Thank you.

Re: How do you create a total column in a chart?

renjith_nair — Mon, 17 Sep 2018 13:59:37 GMT

@barrowvian,

Just add to your search |eventstats sum("Unique Users") as Total to get a total in each record

Re: How do you create a total column in a chart?

barrowvian — Tue, 18 Sep 2018 06:44:41 GMT

Thanks, but this creates a separate column with a value in each of the rows ..

e.g.
User_Name Unique Users Total
User1 1 3
User2 1 3
User3 1 3

Is there a way to just have one field with the total value in instead? Thank you.

Re: How do you create a total column in a chart?

renjith_nair — Tue, 18 Sep 2018 06:51:13 GMT

@barrowvian,
Ofcourse we can do it. just to be clear, how does your final output should look like?

Re: How do you create a total column in a chart?

harishalipaka — Tue, 18 Sep 2018 07:09:42 GMT

hi @barrowvian

try to add end of your query with | addtotals or | addcoltotals

Re: How do you create a total column in a chart?

barrowvian — Tue, 18 Sep 2018 07:15:20 GMT

That worked perfectly, thank you. Was literally just reading about it as you posted.

Re: How do you create a total column in a chart?

barrowvian — Tue, 18 Sep 2018 07:16:25 GMT

|addcoltotals