topic Re: AddColTotal value in a new column in Splunk Search

AddColTotal value in a new column

zacksoft — Wed, 03 Jan 2018 13:06:39 GMT

I use addcoltotal for one of my columns .
But my result has a lot of rows, so I have to browse a lot of pages to find my sum result at the bottom.
Can we have the sum/result in a new column instead ?

Re: AddColTotal value in a new column

risgupta — Wed, 03 Jan 2018 13:11:01 GMT

you can try
| addtotals col=t row=f

Let me know if that helps you.

Re: AddColTotal value in a new column

zacksoft — Wed, 03 Jan 2018 13:14:33 GMT

I have 5 columns.
I need to calculate the total of the third column only.
And instead of seeing the total of it at the bottom of the result, I want to see it , say on the first row of a newly created sixth column called Sum_calculated.

Re: AddColTotal value in a new column

zacksoft — Wed, 03 Jan 2018 13:23:52 GMT

Re: AddColTotal value in a new column

risgupta — Wed, 03 Jan 2018 14:41:32 GMT

I think this answer can help your query
https://answers.splunk.com/answers/478795/how-to-append-columns-based-on-searches-and-row-va.html

Please check the same.

Re: AddColTotal value in a new column

mayurr98 — Wed, 03 Jan 2018 16:06:46 GMT

Hey @zacksoft

As per your comments you want total of third column in the new column right?
Let suppose your third column name is third_column

Then your query will be

Your base search with all 5 columns | eventstats sum(third_column) as total

After this you will get the total which will be reflected at every line in the new column called total

Another solution is if you are just interested in total
Then try this

Your base search will all 5 columns | addcoltotals third_column | tail 1

Let me know if this helps you!

Re: AddColTotal value in a new column

mayurr98 — Thu, 04 Jan 2018 07:05:59 GMT

hey, @zacksoft have you tried above two queries?

Re: AddColTotal value in a new column

zacksoft — Thu, 04 Jan 2018 07:48:41 GMT

I'm trying this now.

Re: AddColTotal value in a new column

zacksoft — Thu, 04 Jan 2018 08:10:39 GMT

Hi @mayurr98,

I tried both the queries , both works . I am more interested towards the first query.
The only thing is, it shows the sum of third row in a newly created column called total "in every row".
Is it possible to have the sum only in the first row ?

Re: AddColTotal value in a new column

mayurr98 — Thu, 04 Jan 2018 10:06:43 GMT

hey, you can show it using appendcols command but it will take longer to run.
Try this !

Your base search with all 5 columns | appendcols [Your base search with all 5 columns  | eventstats sum(third_column) as total | head 1]

otherwise, i do not think any other solution for this!
let me know if this helps you!