<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Re: summation of row values in Splunk Search</title>
    <link>https://community.splunk.com/t5/Splunk-Search/summation-of-row-values/m-p/93580#M24111</link>
    <description>&lt;P&gt;Hi,&lt;/P&gt;

&lt;P&gt;Can you please show me one example to use that.&lt;/P&gt;

&lt;P&gt;Please, it is a kind request&lt;/P&gt;</description>
    <pubDate>Fri, 26 Oct 2012 12:32:01 GMT</pubDate>
    <dc:creator>abhayneilam</dc:creator>
    <dc:date>2012-10-26T12:32:01Z</dc:date>
    <item>
      <title>summation of row values</title>
      <link>https://community.splunk.com/t5/Splunk-Search/summation-of-row-values/m-p/93578#M24109</link>
      <description>&lt;P&gt;I have a report like this :&lt;/P&gt;

&lt;P&gt;keyword  "one" "two" "three"&lt;BR /&gt;
mumbai    5    3      2&lt;BR /&gt;
kolkata   2    2      1 &lt;BR /&gt;
chennai   0    6      4&lt;/P&gt;

&lt;P&gt;I want my output like this :&lt;/P&gt;

&lt;P&gt;keyword  sum  "one" "two" "three"&lt;BR /&gt;
mumbai    10    5    3      2&lt;BR /&gt;
kolkata   5     2    2      1 &lt;BR /&gt;
chennai   10    0    6      4&lt;/P&gt;

&lt;P&gt;sum is the field which is the summation of each row&lt;/P&gt;

&lt;P&gt;Please help &lt;/P&gt;

&lt;P&gt;Thanks in advance,&lt;BR /&gt;
Abhay&lt;/P&gt;</description>
      <pubDate>Wed, 17 Oct 2012 17:53:15 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Splunk-Search/summation-of-row-values/m-p/93578#M24109</guid>
      <dc:creator>abhayneilam</dc:creator>
      <dc:date>2012-10-17T17:53:15Z</dc:date>
    </item>
    <item>
      <title>Re: summation of row values</title>
      <link>https://community.splunk.com/t5/Splunk-Search/summation-of-row-values/m-p/93579#M24110</link>
      <description>&lt;P&gt;Have a look at the &lt;CODE&gt;addtotals&lt;/CODE&gt; command.&lt;/P&gt;

&lt;P&gt;&lt;A href="http://docs.splunk.com/Documentation/Splunk/5.0/SearchReference/Addtotals"&gt;http://docs.splunk.com/Documentation/Splunk/5.0/SearchReference/Addtotals&lt;/A&gt;&lt;/P&gt;</description>
      <pubDate>Wed, 17 Oct 2012 18:35:32 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Splunk-Search/summation-of-row-values/m-p/93579#M24110</guid>
      <dc:creator>Ayn</dc:creator>
      <dc:date>2012-10-17T18:35:32Z</dc:date>
    </item>
    <item>
      <title>Re: summation of row values</title>
      <link>https://community.splunk.com/t5/Splunk-Search/summation-of-row-values/m-p/93580#M24111</link>
      <description>&lt;P&gt;Hi,&lt;/P&gt;

&lt;P&gt;Can you please show me one example to use that.&lt;/P&gt;

&lt;P&gt;Please, it is a kind request&lt;/P&gt;</description>
      <pubDate>Fri, 26 Oct 2012 12:32:01 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Splunk-Search/summation-of-row-values/m-p/93580#M24111</guid>
      <dc:creator>abhayneilam</dc:creator>
      <dc:date>2012-10-26T12:32:01Z</dc:date>
    </item>
    <item>
      <title>Re: summation of row values</title>
      <link>https://community.splunk.com/t5/Splunk-Search/summation-of-row-values/m-p/93581#M24112</link>
      <description>&lt;P&gt;The docs provide examples. It's as easy as adding &lt;CODE&gt;| addtotals&lt;/CODE&gt; at the end of your search. What is it you don't understand?&lt;/P&gt;</description>
      <pubDate>Fri, 26 Oct 2012 12:37:52 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Splunk-Search/summation-of-row-values/m-p/93581#M24112</guid>
      <dc:creator>Ayn</dc:creator>
      <dc:date>2012-10-26T12:37:52Z</dc:date>
    </item>
  </channel>
</rss>

