topic Re: using addcoltotals in Splunk Search

using addcoltotals

dolj — Wed, 09 Aug 2023 20:24:09 GMT

Can you leverage the total derived using the addcoltotals command to support other calculations? i.e. can you use it to calculate a percentage?

| addcoltotals count labelfield="total"
| eval percent=((count/total)*100)
| table host count percent

Re: using addcoltotals

richgalloway — Wed, 09 Aug 2023 20:41:23 GMT

Yes, the output of the addcoltotals command can be used to perform calculations. The sample code, however, won't work. That's because the value of the "total" field created by addcoltotals is text (the label) rather than a number so the eval will fail.

Another way to get percentages is to use eventstats to compute the total then eval the percentage.

| eventstats sum(count) as total | eval percent=((count/total)*100) | table host count percent

Re: using addcoltotals

bowesmana — Thu, 10 Aug 2023 06:26:26 GMT

You can't use the total calculated by addcoltotals as it's in a new row at the bottom of the table, however, as @richgalloway the typical way to calculate percentages is to use eventstats to add up all the counts, so that the total is added to _every_ row in your data set, which you can then calculate the percentages with.

Then discard that calculated total field if you no longer need it