topic Re: Addcoltotals Command Issue in Splunk Search

Addcoltotals Command Issue

manpreetsingh29 — Fri, 12 Apr 2024 15:59:48 GMT

Hi Splunkers,

I am facing weird issue with addcoltotals command. While it is working perfectly fine if i open a new search tab but once i add the same query in Dashboard it is breaking down. I am trying to run the command in SplunkDB connect. Below is the snippet for reference.

Below is the query

Let me know if anyone know why it is happening,

Re: Addcoltotals Command Issue

ITWhisperer — Fri, 12 Apr 2024 15:24:30 GMT

What do you mean by "breaking down"?

Re: Addcoltotals Command Issue

manpreetsingh29 — Fri, 12 Apr 2024 16:14:01 GMT

Mean to say not getting the required result.You can find the same in the snippet attached.

Re: Addcoltotals Command Issue

ITWhisperer — Fri, 12 Apr 2024 16:30:32 GMT

Try without the penultimate search

|search MOP=*

It isn't necessary as stats by MOP effectively does the same thing i.e. you will only get stats for non-null values of MOP which is what the search is doing as well

Re: Addcoltotals Command Issue

manpreetsingh29 — Fri, 12 Apr 2024 17:16:39 GMT

Still facing the same issue. It is intermittent sometime it is working and sometime not.I should get Total_GB1 and total of all column but instead i am getting 18 in place of Total_GB1 and penultimate value is getting printed in 18.

Re: Addcoltotals Command Issue

yuanliu — Sun, 14 Apr 2024 02:08:15 GMT

addtotals is the wrong tool for what you wanted. (It is really bad to use screenshot to illustrate text output. Always use text unless you are illustrating a visual effect.) addcoltotals is what you need.

| addcoltotals labelfield=MOP