https://community.splunk.com/t5/Splunk-Search/AddColTotals/m-p/65422#M180385 <P>You should be able to just name the fields you want totals for.</P> <PRE><CODE>sourcetype=access_combined_wcookie host="qqqq" uri=/checklogin status&gt;400 | stats count by status | addcoltotals count label=Total labelfield=status </CODE></PRE> Mon, 17 Jun 2013 16:05:43 GMT bmunson_splunk 2013-06-17T16:05:43Z https://community.splunk.com/t5/Splunk-Search/AddColTotals/m-p/65420#M180383 <P>Hi, I want to get the count of errors. So i have a query to get the count by status where status is greater than 400. When i use addcoltotals, it is thinking status as a column and hence it is giving the total for both. How can i get that? </P> <P>/Current<BR /> No status count<BR /> 1 200 26<BR /> 2 302 57<BR /> 3 502 83</P> <P>Expected</P> <P>No status count<BR /> 1 200 26<BR /> 2 302 57<BR /> 3 Total 83</P> <P>sourcetype=access_combined_wcookie host="qqqq*" uri=/checklogin* status&gt;400 | stats count by status | addcoltotals label=Total labelfield=status</P> Mon, 28 Sep 2020 14:06:53 GMT https://community.splunk.com/t5/Splunk-Search/AddColTotals/m-p/65420#M180383 xvxt006 2020-09-28T14:06:53Z https://community.splunk.com/t5/Splunk-Search/AddColTotals/m-p/65421#M180384 <P>I don't think it's possible to exclude with addColTotals, but you should be able to with addTotals. Here's the documentation: <A href="http://docs.splunk.com/Documentation/Splunk/5.0.3/SearchReference/Addtotals" target="_blank">http://docs.splunk.com/Documentation/Splunk/5.0.3/SearchReference/Addtotals</A></P> <P>Your search would look like this:<BR /> sourcetype=access_combined_wcookie host="qqqq" uri=/checklogin status&gt;400 | stats count by status | addTotals col=t label=Total labelfield=status count</P> Mon, 28 Sep 2020 14:06:59 GMT https://community.splunk.com/t5/Splunk-Search/AddColTotals/m-p/65421#M180384 aholzer 2020-09-28T14:06:59Z https://community.splunk.com/t5/Splunk-Search/AddColTotals/m-p/65422#M180385 <P>You should be able to just name the fields you want totals for.</P> <PRE><CODE>sourcetype=access_combined_wcookie host="qqqq" uri=/checklogin status&gt;400 | stats count by status | addcoltotals count label=Total labelfield=status </CODE></PRE> Mon, 17 Jun 2013 16:05:43 GMT https://community.splunk.com/t5/Splunk-Search/AddColTotals/m-p/65422#M180385 bmunson_splunk 2013-06-17T16:05:43Z https://community.splunk.com/t5/Splunk-Search/AddColTotals/m-p/65423#M180386 <P>Thank you !!! This worked fine.</P> Mon, 17 Jun 2013 19:31:14 GMT https://community.splunk.com/t5/Splunk-Search/AddColTotals/m-p/65423#M180386 xvxt006 2013-06-17T19:31:14Z