topic AddColTotals & Percentage Column in Splunk Search

AddColTotals & Percentage Column

behymejt2012 — Wed, 11 Sep 2013 16:18:18 GMT

Hi Everyone,

I have an existing table that includes several columns filled with numeric values and one column that creates percentage based off several of the existing columns. When adding in addcoltotals at the end of the statement, it adds the numeric columns correctly, but it adds all the percentage column values together.

Is there a way to have that addcoltotals percentage column be an average percentage total instead of an overall sum of all percentage?

Re: AddColTotals & Percentage Column

lguinn2 — Wed, 11 Sep 2013 18:57:18 GMT

You can't do that with addcoltotals. However, you can do something like this

yoursearchhere
| addcoltotals field1 field2 field3

where field1 field2 field3 is a list of the fields that you want to total.

Re: AddColTotals & Percentage Column

Kyle_Jackson — Wed, 21 May 2014 13:02:05 GMT

Figured it out, I had the same problem.
Add all the columns EXCEPT for the percentage column.
You should now have all totals except for the percentage column.
Do an eval looking for the null percentage column and calculate the percentage.

   ... | yoursearch | addcoltotals twomonth_job_failures twomonth_job_runs labelfield="myfield" | eval OneMonthPercentage=if(isnull(OneMonthPercentage), round((twomonth_job_failures/twomonth_job_runs)*100,2) , OneMonthPercentage)

Re: AddColTotals & Percentage Column

demkic — Mon, 28 Nov 2016 03:15:42 GMT

Hi there,
Is there a way that I can divide the values from field1 by the column total of field1 and display in a new field4? thank you

Re: AddColTotals & Percentage Column

gcusello — Mon, 28 Nov 2016 09:02:07 GMT

Hi behymejt2012,
using addcoltotals command you can specify the field list that you want to summarize

see the example in Splunk Documentation page http://docs.splunk.com/Documentation/Splunk/6.5.0/SearchReference/Addcoltotals

sourcetype=access_* | table userId bytes avgTime duration | addcoltotals bytes duration

Bye.
Giuseppe