<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic How do I add the values in a single row and three columns? in Splunk Search</title>
    <link>https://community.splunk.com/t5/Splunk-Search/How-do-I-add-the-values-in-a-single-row-and-three-columns/m-p/588741#M205028</link>
    <description>&lt;P&gt;stats count(eval(searchmatch(Bala))) as A&amp;nbsp;count(eval(searchmatch(kasa))) as B&amp;nbsp;count(eval(searchmatch(reddy))) as C&amp;nbsp;&lt;/P&gt;
&lt;TABLE border="1" width="69.44444444444446%"&gt;
&lt;TBODY&gt;
&lt;TR&gt;
&lt;TD width="33.333333333333336%"&gt;A&lt;/TD&gt;
&lt;TD width="33.333333333333336%"&gt;B&lt;/TD&gt;
&lt;TD width="16.666666666666668%"&gt;C&lt;/TD&gt;
&lt;/TR&gt;
&lt;TR&gt;
&lt;TD width="33.333333333333336%"&gt;1&lt;/TD&gt;
&lt;TD width="33.333333333333336%"&gt;2&lt;/TD&gt;
&lt;TD width="16.666666666666668%"&gt;3&lt;/TD&gt;
&lt;/TR&gt;
&lt;/TBODY&gt;
&lt;/TABLE&gt;
&lt;P&gt;&amp;nbsp;&lt;/P&gt;
&lt;P&gt;now i want the total of these row values as single table&lt;/P&gt;
&lt;P&gt;&amp;nbsp;&lt;/P&gt;
&lt;TABLE border="1" width="100%"&gt;
&lt;TBODY&gt;
&lt;TR&gt;
&lt;TD width="100%" height="25px"&gt;Total&lt;/TD&gt;
&lt;/TR&gt;
&lt;TR&gt;
&lt;TD width="100%" height="25px"&gt;6&lt;/TD&gt;
&lt;/TR&gt;
&lt;/TBODY&gt;
&lt;/TABLE&gt;</description>
    <pubDate>Fri, 11 Mar 2022 15:43:12 GMT</pubDate>
    <dc:creator>Bala</dc:creator>
    <dc:date>2022-03-11T15:43:12Z</dc:date>
    <item>
      <title>How do I add the values in a single row and three columns?</title>
      <link>https://community.splunk.com/t5/Splunk-Search/How-do-I-add-the-values-in-a-single-row-and-three-columns/m-p/588741#M205028</link>
      <description>&lt;P&gt;stats count(eval(searchmatch(Bala))) as A&amp;nbsp;count(eval(searchmatch(kasa))) as B&amp;nbsp;count(eval(searchmatch(reddy))) as C&amp;nbsp;&lt;/P&gt;
&lt;TABLE border="1" width="69.44444444444446%"&gt;
&lt;TBODY&gt;
&lt;TR&gt;
&lt;TD width="33.333333333333336%"&gt;A&lt;/TD&gt;
&lt;TD width="33.333333333333336%"&gt;B&lt;/TD&gt;
&lt;TD width="16.666666666666668%"&gt;C&lt;/TD&gt;
&lt;/TR&gt;
&lt;TR&gt;
&lt;TD width="33.333333333333336%"&gt;1&lt;/TD&gt;
&lt;TD width="33.333333333333336%"&gt;2&lt;/TD&gt;
&lt;TD width="16.666666666666668%"&gt;3&lt;/TD&gt;
&lt;/TR&gt;
&lt;/TBODY&gt;
&lt;/TABLE&gt;
&lt;P&gt;&amp;nbsp;&lt;/P&gt;
&lt;P&gt;now i want the total of these row values as single table&lt;/P&gt;
&lt;P&gt;&amp;nbsp;&lt;/P&gt;
&lt;TABLE border="1" width="100%"&gt;
&lt;TBODY&gt;
&lt;TR&gt;
&lt;TD width="100%" height="25px"&gt;Total&lt;/TD&gt;
&lt;/TR&gt;
&lt;TR&gt;
&lt;TD width="100%" height="25px"&gt;6&lt;/TD&gt;
&lt;/TR&gt;
&lt;/TBODY&gt;
&lt;/TABLE&gt;</description>
      <pubDate>Fri, 11 Mar 2022 15:43:12 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Splunk-Search/How-do-I-add-the-values-in-a-single-row-and-three-columns/m-p/588741#M205028</guid>
      <dc:creator>Bala</dc:creator>
      <dc:date>2022-03-11T15:43:12Z</dc:date>
    </item>
    <item>
      <title>Re: add the values in a single row and three columns</title>
      <link>https://community.splunk.com/t5/Splunk-Search/How-do-I-add-the-values-in-a-single-row-and-three-columns/m-p/588742#M205029</link>
      <description>&lt;P&gt;Hi&amp;nbsp;&lt;a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/242136"&gt;@Bala&lt;/a&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;use&lt;/P&gt;&lt;P&gt;| addtotals |fields -A,B,C&amp;nbsp; it should give you total 6&lt;/P&gt;</description>
      <pubDate>Fri, 11 Mar 2022 14:27:11 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Splunk-Search/How-do-I-add-the-values-in-a-single-row-and-three-columns/m-p/588742#M205029</guid>
      <dc:creator>venky1544</dc:creator>
      <dc:date>2022-03-11T14:27:11Z</dc:date>
    </item>
    <item>
      <title>Re: add the values in a single row and three columns</title>
      <link>https://community.splunk.com/t5/Splunk-Search/How-do-I-add-the-values-in-a-single-row-and-three-columns/m-p/588743#M205030</link>
      <description>&lt;P&gt;| addtotals&amp;nbsp;&lt;/P&gt;&lt;P&gt;will give&amp;nbsp; the results by adding one more column at the table like below&lt;/P&gt;&lt;TABLE border="1" width="100%"&gt;&lt;TBODY&gt;&lt;TR&gt;&lt;TD width="25%"&gt;A&lt;/TD&gt;&lt;TD width="25%"&gt;B&lt;/TD&gt;&lt;TD width="25%"&gt;C&lt;/TD&gt;&lt;TD width="25%"&gt;Total&lt;/TD&gt;&lt;/TR&gt;&lt;TR&gt;&lt;TD width="25%"&gt;1&lt;/TD&gt;&lt;TD width="25%"&gt;2&lt;/TD&gt;&lt;TD width="25%"&gt;3&lt;/TD&gt;&lt;TD width="25%"&gt;6&lt;/TD&gt;&lt;/TR&gt;&lt;/TBODY&gt;&lt;/TABLE&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;but i want it as single table , i want to dispaly the total as below&lt;/P&gt;&lt;TABLE border="1" width="100%"&gt;&lt;TBODY&gt;&lt;TR&gt;&lt;TD width="100%"&gt;Total&lt;/TD&gt;&lt;/TR&gt;&lt;TR&gt;&lt;TD width="100%"&gt;6&lt;/TD&gt;&lt;/TR&gt;&lt;/TBODY&gt;&lt;/TABLE&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;</description>
      <pubDate>Fri, 11 Mar 2022 14:24:21 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Splunk-Search/How-do-I-add-the-values-in-a-single-row-and-three-columns/m-p/588743#M205030</guid>
      <dc:creator>Bala</dc:creator>
      <dc:date>2022-03-11T14:24:21Z</dc:date>
    </item>
    <item>
      <title>Re: add the values in a single row and three columns</title>
      <link>https://community.splunk.com/t5/Splunk-Search/How-do-I-add-the-values-in-a-single-row-and-three-columns/m-p/588746#M205032</link>
      <description>&lt;P&gt;Yes, i got the result now i want to rename the total as Failure&lt;/P&gt;</description>
      <pubDate>Fri, 11 Mar 2022 15:23:32 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Splunk-Search/How-do-I-add-the-values-in-a-single-row-and-three-columns/m-p/588746#M205032</guid>
      <dc:creator>Bala</dc:creator>
      <dc:date>2022-03-11T15:23:32Z</dc:date>
    </item>
    <item>
      <title>Re: add the values in a single row and three columns</title>
      <link>https://community.splunk.com/t5/Splunk-Search/How-do-I-add-the-values-in-a-single-row-and-three-columns/m-p/588749#M205033</link>
      <description>&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;FYI&amp;nbsp;&lt;/P&gt;&lt;P&gt;&lt;span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="venky1544_1-1647012265053.png" style="width: 400px;"&gt;&lt;img src="https://community.splunk.com/t5/image/serverpage/image-id/18455i131F1F0D90F5068F/image-size/medium?v=v2&amp;amp;px=400" role="button" title="venky1544_1-1647012265053.png" alt="venky1544_1-1647012265053.png" /&gt;&lt;/span&gt;&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;</description>
      <pubDate>Fri, 11 Mar 2022 15:24:58 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Splunk-Search/How-do-I-add-the-values-in-a-single-row-and-three-columns/m-p/588749#M205033</guid>
      <dc:creator>venky1544</dc:creator>
      <dc:date>2022-03-11T15:24:58Z</dc:date>
    </item>
    <item>
      <title>Re: add the values in a single row and three columns</title>
      <link>https://community.splunk.com/t5/Splunk-Search/How-do-I-add-the-values-in-a-single-row-and-three-columns/m-p/588752#M205034</link>
      <description>&lt;P&gt;&lt;SPAN&gt;Yes, i got the result now i want to rename the total as Failure&lt;/SPAN&gt;&lt;/P&gt;&lt;P&gt;&lt;SPAN&gt;And also what if i want to add only the B &amp;amp; C column values and A keep remain same.&lt;/SPAN&gt;&lt;/P&gt;&lt;TABLE border="1" width="56.25%"&gt;&lt;TBODY&gt;&lt;TR&gt;&lt;TD width="25%"&gt;A&lt;/TD&gt;&lt;TD width="25%"&gt;B&lt;/TD&gt;&lt;TD width="25%"&gt;C&lt;/TD&gt;&lt;/TR&gt;&lt;TR&gt;&lt;TD width="25%"&gt;1&lt;/TD&gt;&lt;TD width="25%"&gt;2&lt;/TD&gt;&lt;TD width="25%"&gt;3&lt;/TD&gt;&lt;/TR&gt;&lt;/TBODY&gt;&lt;/TABLE&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;Result should be&lt;/P&gt;&lt;TABLE border="1" width="100%"&gt;&lt;TBODY&gt;&lt;TR&gt;&lt;TD width="50%"&gt;A&lt;/TD&gt;&lt;TD width="50%"&gt;Total (rename it as count)&lt;/TD&gt;&lt;/TR&gt;&lt;TR&gt;&lt;TD width="50%"&gt;1&lt;/TD&gt;&lt;TD width="50%"&gt;5&lt;/TD&gt;&lt;/TR&gt;&lt;/TBODY&gt;&lt;/TABLE&gt;</description>
      <pubDate>Fri, 11 Mar 2022 15:33:32 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Splunk-Search/How-do-I-add-the-values-in-a-single-row-and-three-columns/m-p/588752#M205034</guid>
      <dc:creator>Bala</dc:creator>
      <dc:date>2022-03-11T15:33:32Z</dc:date>
    </item>
    <item>
      <title>Re: add the values in a single row and three columns</title>
      <link>https://community.splunk.com/t5/Splunk-Search/How-do-I-add-the-values-in-a-single-row-and-three-columns/m-p/588755#M205035</link>
      <description>&lt;P&gt;Hi&amp;nbsp;&lt;a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/242136"&gt;@Bala&lt;/a&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;Just use the rename command should work&amp;nbsp;&lt;/P&gt;&lt;P&gt;| addtotals |fields - A,B,C |rename Total as Failure&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;Note : PLease accept the solution if the reply worked for you it might help others as well&amp;nbsp;&lt;/P&gt;</description>
      <pubDate>Fri, 11 Mar 2022 15:39:10 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Splunk-Search/How-do-I-add-the-values-in-a-single-row-and-three-columns/m-p/588755#M205035</guid>
      <dc:creator>venky1544</dc:creator>
      <dc:date>2022-03-11T15:39:10Z</dc:date>
    </item>
    <item>
      <title>Re: add the values in a single row and three columns</title>
      <link>https://community.splunk.com/t5/Splunk-Search/How-do-I-add-the-values-in-a-single-row-and-three-columns/m-p/588757#M205036</link>
      <description>&lt;P&gt;&lt;SPAN&gt;Yes, i got the result now i want to rename the total as Failure&lt;/SPAN&gt;&lt;/P&gt;&lt;P&gt;&lt;SPAN&gt;And also what if i want to add only the B &amp;amp; C column values and A keep remain same.&lt;/SPAN&gt;&lt;/P&gt;&lt;TABLE border="1" width="56.25%"&gt;&lt;TBODY&gt;&lt;TR&gt;&lt;TD width="25%"&gt;A&lt;/TD&gt;&lt;TD width="25%"&gt;B&lt;/TD&gt;&lt;TD width="25%"&gt;C&lt;/TD&gt;&lt;/TR&gt;&lt;TR&gt;&lt;TD width="25%"&gt;1&lt;/TD&gt;&lt;TD width="25%"&gt;2&lt;/TD&gt;&lt;TD width="25%"&gt;3&lt;/TD&gt;&lt;/TR&gt;&lt;/TBODY&gt;&lt;/TABLE&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;Result should be&lt;/P&gt;&lt;TABLE border="1" width="100%"&gt;&lt;TBODY&gt;&lt;TR&gt;&lt;TD width="50%"&gt;A&lt;/TD&gt;&lt;TD width="50%"&gt;Total (rename it as count)&lt;/TD&gt;&lt;/TR&gt;&lt;TR&gt;&lt;TD width="50%"&gt;1&lt;/TD&gt;&lt;TD width="50%"&gt;5&lt;/TD&gt;&lt;/TR&gt;&lt;/TBODY&gt;&lt;/TABLE&gt;</description>
      <pubDate>Fri, 11 Mar 2022 15:46:38 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Splunk-Search/How-do-I-add-the-values-in-a-single-row-and-three-columns/m-p/588757#M205036</guid>
      <dc:creator>Bala</dc:creator>
      <dc:date>2022-03-11T15:46:38Z</dc:date>
    </item>
    <item>
      <title>Re: add the values in a single row and three columns</title>
      <link>https://community.splunk.com/t5/Splunk-Search/How-do-I-add-the-values-in-a-single-row-and-three-columns/m-p/588760#M205039</link>
      <description>&lt;P&gt;|makeresults |eval Name1="Bala",Name2="kasa",Name3="Reddy"&lt;BR /&gt;|append [|makeresults |eval Name2="kasa",Name3="Reddy"]&lt;BR /&gt;|append [|makeresults |eval Name3="Reddy"]|&lt;BR /&gt;stats count(eval(Name1="Bala")) AS A,count(eval(Name2="kasa")) AS B,count(eval(Name3="Reddy")) AS C | eval count=B+C |fields - B,C&lt;/P&gt;</description>
      <pubDate>Fri, 11 Mar 2022 15:59:40 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Splunk-Search/How-do-I-add-the-values-in-a-single-row-and-three-columns/m-p/588760#M205039</guid>
      <dc:creator>venky1544</dc:creator>
      <dc:date>2022-03-11T15:59:40Z</dc:date>
    </item>
  </channel>
</rss>

