https://community.splunk.com/t5/Splunk-Search/How-do-display-only-the-total-row/m-p/169249#M48351 <P>Total is not a field. it added by addtolcol command.</P> <P>I need to display column names row and total row</P> Wed, 24 Dec 2014 11:05:41 GMT rsathish47 2014-12-24T11:05:41Z https://community.splunk.com/t5/Splunk-Search/How-do-display-only-the-total-row/m-p/169247#M48349 <P>Hi all,</P> <P>I would like to diplay only the row please help </P> <P>ser Captured Processe Co1 col3 col4 .. .. ..<BR /> Serv01 482 84107<BR /> Serv02 497 84162<BR /> Serv03 482 84150<BR /> Serv04 457 84087<BR /> Serv05 500 84175<BR /> Serv06 494 84206<BR /> Total 2912 504887 .. . . .. . . . .. </P> <P>I need</P> <P>ser Captured Processe Co11 col13 col14 .. .. ..<BR /> Total 2912 504887 .. . . .. .. . . </P> Wed, 24 Dec 2014 10:02:27 GMT https://community.splunk.com/t5/Splunk-Search/How-do-display-only-the-total-row/m-p/169247#M48349 rsathish47 2014-12-24T10:02:27Z https://community.splunk.com/t5/Splunk-Search/How-do-display-only-the-total-row/m-p/169248#M48350 <P>Hi,<BR /> Not sure to understand your table.<BR /> Is this from your logs or the result of a search?</P> <P>If it's a result of a search, try:</P> <PRE><CODE>Your search | fields + Total </CODE></PRE> <P>'Total' is the name of the field you want to display.</P> Wed, 24 Dec 2014 10:48:04 GMT https://community.splunk.com/t5/Splunk-Search/How-do-display-only-the-total-row/m-p/169248#M48350 bgaignon 2014-12-24T10:48:04Z https://community.splunk.com/t5/Splunk-Search/How-do-display-only-the-total-row/m-p/169249#M48351 <P>Total is not a field. it added by addtolcol command.</P> <P>I need to display column names row and total row</P> Wed, 24 Dec 2014 11:05:41 GMT https://community.splunk.com/t5/Splunk-Search/How-do-display-only-the-total-row/m-p/169249#M48351 rsathish47 2014-12-24T11:05:41Z https://community.splunk.com/t5/Splunk-Search/How-do-display-only-the-total-row/m-p/169250#M48352 <P>Filter search result rows using <CODE>where</CODE>:</P> <P><CODE>...your search... | where ser="Total"</CODE></P> Wed, 24 Dec 2014 12:42:09 GMT https://community.splunk.com/t5/Splunk-Search/How-do-display-only-the-total-row/m-p/169250#M48352 aweitzman 2014-12-24T12:42:09Z https://community.splunk.com/t5/Splunk-Search/How-do-display-only-the-total-row/m-p/169251#M48353 <P>Consider replacing <CODE>... | addcoltotals</CODE> with <CODE>... | stats sum(*) as *</CODE>.</P> Thu, 25 Dec 2014 04:20:57 GMT https://community.splunk.com/t5/Splunk-Search/How-do-display-only-the-total-row/m-p/169251#M48353 martin_mueller 2014-12-25T04:20:57Z https://community.splunk.com/t5/Splunk-Search/How-do-display-only-the-total-row/m-p/169252#M48354 <P>Thanks aweitzman .. It works</P> Mon, 29 Dec 2014 07:27:21 GMT https://community.splunk.com/t5/Splunk-Search/How-do-display-only-the-total-row/m-p/169252#M48354 rsathish47 2014-12-29T07:27:21Z https://community.splunk.com/t5/Splunk-Search/How-do-display-only-the-total-row/m-p/169253#M48355 <P>Thank You Martin it also works</P> Mon, 29 Dec 2014 07:30:29 GMT https://community.splunk.com/t5/Splunk-Search/How-do-display-only-the-total-row/m-p/169253#M48355 rsathish47 2014-12-29T07:30:29Z