topic how to add the total in GB in Splunk Search https://community.splunk.com/t5/Splunk-Search/how-to-add-the-total-in-GB/m-p/697311#M236895 <P>I need to add the total GB.&nbsp; Please let me know how to add the over all total.&nbsp;</P><DIV>Index&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Source-Type&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; GB</DIV><DIV>aws_vpcflow&nbsp; &nbsp;- aws:vpcflow&nbsp; &nbsp; 26192.00305</DIV><DIV><SPAN>&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; -&nbsp; &nbsp;aws:cloudwatchlogs:vpcflow 32.695269</SPAN></DIV><DIV>windows&nbsp; &nbsp; &nbsp;-&nbsp; &nbsp; &nbsp;windows:fluentd&nbsp; &nbsp; &nbsp;19939.02727</DIV><DIV><SPAN>&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;-&nbsp; &nbsp; &nbsp;windows&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 9713.832884</SPAN></DIV><DIV><SPAN>&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;-&nbsp; &nbsp; &nbsp;WinEventLog:Security&nbsp; &nbsp;8.928759</SPAN></DIV> Mon, 26 Aug 2024 14:49:37 GMT harishsplunk7 2024-08-26T14:49:37Z how to add the total in GB https://community.splunk.com/t5/Splunk-Search/how-to-add-the-total-in-GB/m-p/697311#M236895 <P>I need to add the total GB.&nbsp; Please let me know how to add the over all total.&nbsp;</P><DIV>Index&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Source-Type&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; GB</DIV><DIV>aws_vpcflow&nbsp; &nbsp;- aws:vpcflow&nbsp; &nbsp; 26192.00305</DIV><DIV><SPAN>&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; -&nbsp; &nbsp;aws:cloudwatchlogs:vpcflow 32.695269</SPAN></DIV><DIV>windows&nbsp; &nbsp; &nbsp;-&nbsp; &nbsp; &nbsp;windows:fluentd&nbsp; &nbsp; &nbsp;19939.02727</DIV><DIV><SPAN>&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;-&nbsp; &nbsp; &nbsp;windows&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 9713.832884</SPAN></DIV><DIV><SPAN>&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;-&nbsp; &nbsp; &nbsp;WinEventLog:Security&nbsp; &nbsp;8.928759</SPAN></DIV> Mon, 26 Aug 2024 14:49:37 GMT https://community.splunk.com/t5/Splunk-Search/how-to-add-the-total-in-GB/m-p/697311#M236895 harishsplunk7 2024-08-26T14:49:37Z Re: how to add the total in GB https://community.splunk.com/t5/Splunk-Search/how-to-add-the-total-in-GB/m-p/697312#M236896 <P>You can use&nbsp;addtotals as below -&nbsp;</P><P>| addtotals col=t row=f labelfield=index label="Overall Total"</P><P>&nbsp;</P><P>Please accept the solution and hit Karma, if this helps!</P> Mon, 26 Aug 2024 15:04:33 GMT https://community.splunk.com/t5/Splunk-Search/how-to-add-the-total-in-GB/m-p/697312#M236896 meetmshah 2024-08-26T15:04:33Z Re: how to add the total in GB https://community.splunk.com/t5/Splunk-Search/how-to-add-the-total-in-GB/m-p/697314#M236897 <P class="lia-align-left">If i use the&nbsp;</P> <LI-CODE lang="markup">| addtotals col=t row=f labelfield=Index label="Overall Total"</LI-CODE> <P class="lia-align-left">, I am getting incorrect total result ,<BR />becuase one index and multiple sourcetype values are there.&nbsp;</P> Mon, 26 Aug 2024 15:55:01 GMT https://community.splunk.com/t5/Splunk-Search/how-to-add-the-total-in-GB/m-p/697314#M236897 harishsplunk7 2024-08-26T15:55:01Z Re: how to add the total in GB https://community.splunk.com/t5/Splunk-Search/how-to-add-the-total-in-GB/m-p/697323#M236899 <P>Please share your actual events (anonymised appropriately) in a codeblock</P> Mon, 26 Aug 2024 15:52:27 GMT https://community.splunk.com/t5/Splunk-Search/how-to-add-the-total-in-GB/m-p/697323#M236899 ITWhisperer 2024-08-26T15:52:27Z Re: how to add the total in GB https://community.splunk.com/t5/Splunk-Search/how-to-add-the-total-in-GB/m-p/697325#M236900 <P>Please find teh below sample values</P><TABLE border="1" width="99.87012987012986%"><TBODY><TR><TD width="27.4025974025974%">Index</TD><TD width="55.97402597402598%">Source-Type</TD><TD width="16.493506493506494%">GB</TD></TR><TR><TD width="27.4025974025974%">aws_vpcflow</TD><TD width="55.97402597402598%">aws:vpcflow</TD><TD width="16.493506493506494%">10</TD></TR><TR><TD width="55.97402597402598%">aws:cloudwatchlogs:vpcflow</TD><TD width="16.493506493506494%">20</TD></TR><TR><TD width="27.4025974025974%">windows</TD><TD width="55.97402597402598%">windows:fluentd</TD><TD width="16.493506493506494%">30</TD></TR><TR><TD width="55.97402597402598%">windows</TD><TD width="16.493506493506494%">40</TD></TR><TR><TD width="55.97402597402598%">WinEventLog:Security</TD><TD width="16.493506493506494%">50</TD></TR><TR><TD width="27.4025974025974%">cloud&nbsp;</TD><TD width="55.97402597402598%">cloud_watch</TD><TD width="16.493506493506494%">60</TD></TR><TR><TD width="55.97402597402598%">aws_cloud</TD><TD width="16.493506493506494%">70</TD></TR></TBODY></TABLE> Mon, 26 Aug 2024 15:59:20 GMT https://community.splunk.com/t5/Splunk-Search/how-to-add-the-total-in-GB/m-p/697325#M236900 harishsplunk7 2024-08-26T15:59:20Z Re: how to add the total in GB https://community.splunk.com/t5/Splunk-Search/how-to-add-the-total-in-GB/m-p/697326#M236901 <P>What search did you use to get this table?</P> Mon, 26 Aug 2024 16:00:30 GMT https://community.splunk.com/t5/Splunk-Search/how-to-add-the-total-in-GB/m-p/697326#M236901 ITWhisperer 2024-08-26T16:00:30Z Re: how to add the total in GB https://community.splunk.com/t5/Splunk-Search/how-to-add-the-total-in-GB/m-p/697328#M236902 <LI-CODE lang="markup">index=_internal source=/opt/splunk/var/log/splunk/license_usage.log type=Usage | stats sum(b) as bytes by st , idx | eval GB=round(bytes/(1024*1024*1024),6) | table st, idx, GB | sort -GB | eventstats sum(GB) as total | eval Percentage=round((GB/total)*100,6) | rename st as SourceType | rename idx as Index | stats list(SourceType) as "Source-Type", list(GB) as GB by Index | addtotals col=t row=f labelfield=Index label="Overall Total"</LI-CODE> Mon, 26 Aug 2024 18:09:27 GMT https://community.splunk.com/t5/Splunk-Search/how-to-add-the-total-in-GB/m-p/697328#M236902 harishsplunk7 2024-08-26T18:09:27Z Re: how to add the total in GB https://community.splunk.com/t5/Splunk-Search/how-to-add-the-total-in-GB/m-p/697329#M236903 <P>Try switching the last two lines</P><LI-CODE lang="markup">| addtotals col=t row=f labelfield=Index label="Overall Total" | stats list(SourceType) as "Source-Type", list(GB) as GB by Index</LI-CODE> Mon, 26 Aug 2024 16:13:40 GMT https://community.splunk.com/t5/Splunk-Search/how-to-add-the-total-in-GB/m-p/697329#M236903 ITWhisperer 2024-08-26T16:13:40Z Re: how to add the total in GB https://community.splunk.com/t5/Splunk-Search/how-to-add-the-total-in-GB/m-p/697330#M236904 <P>Or</P><LI-CODE lang="markup">| stats list(SourceType) as "Source-Type", list(GB) as GB by Index | appendpipe [| stats sum(GB) as GB | eval Index="Overall Total"]</LI-CODE> Mon, 26 Aug 2024 16:20:28 GMT https://community.splunk.com/t5/Splunk-Search/how-to-add-the-total-in-GB/m-p/697330#M236904 ITWhisperer 2024-08-26T16:20:28Z