topic Re: Adding column total in new row in Splunk Search

Adding column total in new row

dutabhis07 — Mon, 03 Mar 2014 21:36:36 GMT

Hi,
I have a data set like

Col A Col B
Time 5
Time 5
.
.

I want a new row with the total of Column B, something like

Col A Col B
Time 5
Time 5
Total 10

i know we can use addcoltotals but that adds a new column label.
Some input appreciated.
Thanks

dutabhis07 — Mon, 03 Mar 2014 21:45:37 GMT

yeah .. tried that as well .. but that too gives output something like

Col A Col B
Time 5
Time 5
10

I need to show the Total Alias in the last row

reed_kelly — Mon, 03 Mar 2014 21:51:28 GMT

Take a look at the following. I am filling in the word Total in the endhuman column at the end.

dutabhis07 — Mon, 03 Mar 2014 21:58:07 GMT

Thanks Reed ... That worked ... 🙂

yannK — Mon, 03 Mar 2014 22:26:07 GMT

Another way to get a column total, but it will be for each lines.

<mysearch> | table colA colB | eventstats sum(colB) AS total

ViniciusANT — Thu, 25 Sep 2014 19:44:26 GMT

Try | addcolTotals