topic Re: how to ignore a column using addtotals/addcoltotals in Splunk Search

how to ignore a column using addtotals/addcoltotals

mjhamm75 — Fri, 17 Feb 2012 17:54:11 GMT

Here is my search

index="aries" splunk tt=HL7* | 
chart count by si , tt | 
addtotals |
addcoltotals|
rename si as GenKey | 
rename count as Count

My GenKey/si is is an identifying number. I do not want to add the identifier into my totals, nor do I want a column total of the identifer. How do I ignore the identifier and just add the pertinent data from the table?

Re: how to ignore a column using addtotals/addcoltotals

lguinn2 — Sat, 18 Feb 2012 00:01:20 GMT

I prefer eval to addtotals

eval total=field1 + field2 + field3

Instead of addcoltotals, use the addtotals command with the col option

addtotals col=true field1 field2 field3

BUT, you may have a more fundamental problem. After the second line of your command, you have only 3 fields available in the pipeline: count, si, tt. If that's what you want, then okay. The chart command is also making things weird, so I used the stats command instead

index="aries" splunk tt=HL7* | 
stats count by si , tt | 
eval total = count + tt|
addcoltotals col=t total count tt|
rename si as GenKey | 
rename count as Count

Re: how to ignore a column using addtotals/addcoltotals

ManiKandanS — Fri, 24 Nov 2017 09:34:34 GMT

|addtotals label=total labelfiled=field which you want to remove

Re: how to ignore a column using addtotals/addcoltotals

sjbriggs — Wed, 23 Sep 2020 15:00:10 GMT

I was searching for a solution to the same problem all morning and finally found that I can just specify which fields I want to have in the "Total" column:

|stats sum(GB_in) AS "GB IN", sum(GB_out) AS "GB OUT" by category |addtotals "GB IN" "GB OUT" |sort -Total