https://community.splunk.com/t5/Splunk-Search/How-is-it-possible-to-assign-the-result-of-the-append-subsearch/m-p/233281#M69255 <P>Are you looking to add a new field (in your main search result) which will have sum of values of a column (which you're adding through an append subsearch? If yes then try this</P> <PRE><CODE>your main search | eventstats sum(field1) as TotalField1 </CODE></PRE> Fri, 06 May 2016 15:51:14 GMT somesoni2 2016-05-06T15:51:14Z https://community.splunk.com/t5/Splunk-Search/How-is-it-possible-to-assign-the-result-of-the-append-subsearch/m-p/233280#M69254 <P>Hi,</P> <P>I have a search and an | append [subsearch] which adds at the bottom of the results (see image) a new row with the sum of the values per every column. <BR /> Is there a way to assign those results (see 1317 in the image provided) in a constant or a field (through an eval maybe)?</P> <P><span class="lia-inline-image-display-wrapper" image-alt="alt text"><img src="https://community.splunk.com/t5/image/serverpage/image-id/1317i4C2752209196B427/image-size/large?v=v2&amp;px=999" role="button" title="alt text" alt="alt text" /></span></P> <P>Thanks,<BR /> Skender</P> Fri, 06 May 2016 14:59:05 GMT https://community.splunk.com/t5/Splunk-Search/How-is-it-possible-to-assign-the-result-of-the-append-subsearch/m-p/233280#M69254 skender27 2016-05-06T14:59:05Z https://community.splunk.com/t5/Splunk-Search/How-is-it-possible-to-assign-the-result-of-the-append-subsearch/m-p/233281#M69255 <P>Are you looking to add a new field (in your main search result) which will have sum of values of a column (which you're adding through an append subsearch? If yes then try this</P> <PRE><CODE>your main search | eventstats sum(field1) as TotalField1 </CODE></PRE> Fri, 06 May 2016 15:51:14 GMT https://community.splunk.com/t5/Splunk-Search/How-is-it-possible-to-assign-the-result-of-the-append-subsearch/m-p/233281#M69255 somesoni2 2016-05-06T15:51:14Z https://community.splunk.com/t5/Splunk-Search/How-is-it-possible-to-assign-the-result-of-the-append-subsearch/m-p/233282#M69256 <P>If you are saying to give the last row a name for the leading field without knowing the name of the field/column, you can do this will <CODE>fillnull</CODE> like this:</P> <PRE><CODE>... | fillnull value="Total" </CODE></PRE> Sat, 07 May 2016 13:30:00 GMT https://community.splunk.com/t5/Splunk-Search/How-is-it-possible-to-assign-the-result-of-the-append-subsearch/m-p/233282#M69256 woodcock 2016-05-07T13:30:00Z