topic Re: Adding a column in Splunk Search

Adding a column

Muthu_Vinith — Fri, 02 Feb 2024 01:19:53 GMT

Hi Splunk experts,

I’m a Splunk beginner. I need help with a requirement. I have fields named 'location,' 'login,' and 'desk' with the following values:

location login desk

AA 1 0

BB 1 0

CC 0 10

DD 1 1

EE 0 1

My goal is to create a new location called 'ABC,' which should be the sum of all four locations (AA, BB, CC, DD). I've tried the following search, but it's not summing up all four locations:

| appendpipe [search AA BB CC DD | eval location=“ABC”]

| stats sum(login) as login by desk

Please guide me on how to achieve this. Thank you.

Re: Adding a column

richgalloway — Fri, 02 Feb 2024 01:22:31 GMT

Use the addcoltotals command to sum the values and put them into the location field as "ABC".

... | addcoltotals labelfield=location label="ABC"

Re: Adding a column

ITWhisperer — Fri, 02 Feb 2024 09:31:38 GMT

Please clarify your question - you say you want to add a column but appendpipe will add row(s) - you have 5 locations not 4, do you wish to exclude a particular location or sum the logins for all locations by desk?