https://community.splunk.com/t5/Splunk-Search/How-to-sum-multiple-individual-columns-into-a-flat-row/m-p/466698#M131386 <P>You can use <CODE>addtotals</CODE> to sum the column values like this </P> <P><CODE>| addtotals fieldname=sum</CODE></P> <P><A href="https://docs.splunk.com/Documentation/Splunk/8.0.1/SearchReference/Addtotals">https://docs.splunk.com/Documentation/Splunk/8.0.1/SearchReference/Addtotals</A></P> Thu, 13 Feb 2020 19:54:20 GMT skoelpin 2020-02-13T19:54:20Z https://community.splunk.com/t5/Splunk-Search/How-to-sum-multiple-individual-columns-into-a-flat-row/m-p/466696#M131384 <P>I have a search that based on a lookup that is pulling names and totals over the course of a 24 hour period or week based on time. How can I sum each column without having to sum every field individually?</P> <P><CODE>cdr_events</CODE> duration&gt;0 <BR /> ( (callingPartyGroup="00581" OR originalCalledPartyGroup="00581" OR finalCalledPartyGroup="00581") )<BR /><BR /> | <CODE>calculate_all_internal_parties</CODE><BR /> | lookup groups number as number output name group subgroup<BR /> | search ( group="00581" )<BR /> | timechart dc(callId) by name</P> <P>I could get it by running a | sum("Tony Freeman") as "Tony Freeman" sum("Andrea Cook" as "Andrea Cook" etc etc but is there an easier way to do that?</P> Thu, 13 Feb 2020 18:54:42 GMT https://community.splunk.com/t5/Splunk-Search/How-to-sum-multiple-individual-columns-into-a-flat-row/m-p/466696#M131384 eric_delac 2020-02-13T18:54:42Z https://community.splunk.com/t5/Splunk-Search/How-to-sum-multiple-individual-columns-into-a-flat-row/m-p/466697#M131385 <P><IMG src="https://imgur.com/a/IOiBrmC" alt="alt text" /></P> Thu, 13 Feb 2020 18:59:36 GMT https://community.splunk.com/t5/Splunk-Search/How-to-sum-multiple-individual-columns-into-a-flat-row/m-p/466697#M131385 eric_delac 2020-02-13T18:59:36Z https://community.splunk.com/t5/Splunk-Search/How-to-sum-multiple-individual-columns-into-a-flat-row/m-p/466698#M131386 <P>You can use <CODE>addtotals</CODE> to sum the column values like this </P> <P><CODE>| addtotals fieldname=sum</CODE></P> <P><A href="https://docs.splunk.com/Documentation/Splunk/8.0.1/SearchReference/Addtotals">https://docs.splunk.com/Documentation/Splunk/8.0.1/SearchReference/Addtotals</A></P> Thu, 13 Feb 2020 19:54:20 GMT https://community.splunk.com/t5/Splunk-Search/How-to-sum-multiple-individual-columns-into-a-flat-row/m-p/466698#M131386 skoelpin 2020-02-13T19:54:20Z