<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Re: How do I use the addcoltotals command with a stats list or stats values? in Splunk Search</title>
    <link>https://community.splunk.com/t5/Splunk-Search/How-do-I-use-the-addcoltotals-command-with-a-stats-list-or-stats/m-p/416904#M119971</link>
    <description>&lt;P&gt;Hi,&lt;/P&gt;

&lt;P&gt;Can you try something like that&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;| eventstats sum(Total) as GrandTotal by things
| stats values(Total) as Total, values(example) as example values(GrandTotal) as GrandTotal by thing
| table thing, example, Total,GrandTotal
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;Doing the sum of the Total before should be a good solution.&lt;/P&gt;

&lt;P&gt;KailA&lt;/P&gt;</description>
    <pubDate>Thu, 04 Oct 2018 20:26:25 GMT</pubDate>
    <dc:creator>KailA</dc:creator>
    <dc:date>2018-10-04T20:26:25Z</dc:date>
    <item>
      <title>How do I use the addcoltotals command with a stats list or stats values?</title>
      <link>https://community.splunk.com/t5/Splunk-Search/How-do-I-use-the-addcoltotals-command-with-a-stats-list-or-stats/m-p/416901#M119968</link>
      <description>&lt;P&gt;How do I use &lt;CODE&gt;addcoltotals&lt;/CODE&gt; with a stats list or with stats values?&lt;/P&gt;

&lt;P&gt;I'm trying to include the totals for each line value after running a stats list or values on a field with a numeric value and pipe &lt;CODE&gt;addcoltotals&lt;/CODE&gt; , but it is skipping any values that are represented in my list or values table visualization.  Anyone know how to get this to work?&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;| stats values(Total) as Total, values(example) as example by thing
| table thing, example, Total
| addcoltotals labelfield=thing label="Grand Total:"
&lt;/CODE&gt;&lt;/PRE&gt;</description>
      <pubDate>Thu, 04 Oct 2018 15:41:10 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Splunk-Search/How-do-I-use-the-addcoltotals-command-with-a-stats-list-or-stats/m-p/416901#M119968</guid>
      <dc:creator>johnward4</dc:creator>
      <dc:date>2018-10-04T15:41:10Z</dc:date>
    </item>
    <item>
      <title>Re: How do I use the addcoltotals command with a stats list or stats values?</title>
      <link>https://community.splunk.com/t5/Splunk-Search/How-do-I-use-the-addcoltotals-command-with-a-stats-list-or-stats/m-p/416902#M119969</link>
      <description>&lt;P&gt;Can you please give an example of data or output that you are expecting? Anyways addcoltotals will not work with list or value as they are non-numeric&lt;/P&gt;</description>
      <pubDate>Thu, 04 Oct 2018 18:25:03 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Splunk-Search/How-do-I-use-the-addcoltotals-command-with-a-stats-list-or-stats/m-p/416902#M119969</guid>
      <dc:creator>Vijeta</dc:creator>
      <dc:date>2018-10-04T18:25:03Z</dc:date>
    </item>
    <item>
      <title>Re: How do I use the addcoltotals command with a stats list or stats values?</title>
      <link>https://community.splunk.com/t5/Splunk-Search/How-do-I-use-the-addcoltotals-command-with-a-stats-list-or-stats/m-p/416903#M119970</link>
      <description>&lt;P&gt;&lt;span class="lia-inline-image-display-wrapper" image-alt="alt text"&gt;&lt;img src="https://community.splunk.com/t5/image/serverpage/image-id/5900i24F908EF31A458CA/image-size/large?v=v2&amp;amp;px=999" role="button" title="alt text" alt="alt text" /&gt;&lt;/span&gt;&lt;/P&gt;</description>
      <pubDate>Thu, 04 Oct 2018 20:17:44 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Splunk-Search/How-do-I-use-the-addcoltotals-command-with-a-stats-list-or-stats/m-p/416903#M119970</guid>
      <dc:creator>johnward4</dc:creator>
      <dc:date>2018-10-04T20:17:44Z</dc:date>
    </item>
    <item>
      <title>Re: How do I use the addcoltotals command with a stats list or stats values?</title>
      <link>https://community.splunk.com/t5/Splunk-Search/How-do-I-use-the-addcoltotals-command-with-a-stats-list-or-stats/m-p/416904#M119971</link>
      <description>&lt;P&gt;Hi,&lt;/P&gt;

&lt;P&gt;Can you try something like that&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;| eventstats sum(Total) as GrandTotal by things
| stats values(Total) as Total, values(example) as example values(GrandTotal) as GrandTotal by thing
| table thing, example, Total,GrandTotal
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;Doing the sum of the Total before should be a good solution.&lt;/P&gt;

&lt;P&gt;KailA&lt;/P&gt;</description>
      <pubDate>Thu, 04 Oct 2018 20:26:25 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Splunk-Search/How-do-I-use-the-addcoltotals-command-with-a-stats-list-or-stats/m-p/416904#M119971</guid>
      <dc:creator>KailA</dc:creator>
      <dc:date>2018-10-04T20:26:25Z</dc:date>
    </item>
    <item>
      <title>Re: How do I use the addcoltotals command with a stats list or stats values?</title>
      <link>https://community.splunk.com/t5/Splunk-Search/How-do-I-use-the-addcoltotals-command-with-a-stats-list-or-stats/m-p/416905#M119972</link>
      <description>&lt;P&gt;When you do list or value  even on numeric values I believe the list command converts it into  string and that is why you cannot add multivalued column.  I would rather do it as&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;  stats sum(Total) by Example Thing
&lt;/CODE&gt;&lt;/PRE&gt;</description>
      <pubDate>Thu, 04 Oct 2018 20:30:05 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Splunk-Search/How-do-I-use-the-addcoltotals-command-with-a-stats-list-or-stats/m-p/416905#M119972</guid>
      <dc:creator>Vijeta</dc:creator>
      <dc:date>2018-10-04T20:30:05Z</dc:date>
    </item>
    <item>
      <title>Re: How do I use the addcoltotals command with a stats list or stats values?</title>
      <link>https://community.splunk.com/t5/Splunk-Search/How-do-I-use-the-addcoltotals-command-with-a-stats-list-or-stats/m-p/416906#M119973</link>
      <description>&lt;P&gt;Your search is almost correct try using sum(Total) instead of values.&lt;/P&gt;

&lt;P&gt;Your search | stats sum(Total) as Total by host | addcoltotals labelfield="fieldName" label="GrandTotal" | your table command&lt;/P&gt;</description>
      <pubDate>Fri, 05 Oct 2018 19:10:26 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Splunk-Search/How-do-I-use-the-addcoltotals-command-with-a-stats-list-or-stats/m-p/416906#M119973</guid>
      <dc:creator>vinaykata</dc:creator>
      <dc:date>2018-10-05T19:10:26Z</dc:date>
    </item>
  </channel>
</rss>

