topic Re: How can I add a summary row to a table in Simple XML in Splunk Search

How can I add a summary row to a table in Simple XML

helge — Wed, 29 Mar 2017 21:31:35 GMT

How can I add a summary row to a table in Simple XML? By summary row I am referring to what is described here, i.e. a special row appended to the table UI that is not affected by sorting. In the UI this is available in the Format menu of the Statistics tab.

Example from the documentation linked to above:

Re: How can I add a summary row to a table in Simple XML

niketn — Wed, 29 Mar 2017 22:06:23 GMT

As of Splunk 6.5 the following Simple XML adds a summary and a percentages row:

<option name="percentagesRow">true</option>
<option name="totalsRow">true</option>

Re: How can I add a summary row to a table in Simple XML

frobinson_splun — Wed, 29 Mar 2017 22:11:38 GMT

Thanks for pointing this out! I'll double-check our documentation to make sure these two options are mentioned.

Re: How can I add a summary row to a table in Simple XML

frobinson_splun — Wed, 29 Mar 2017 22:15:11 GMT

Docs are now updated to include these:
http://docs.splunk.com/Documentation/Splunk/6.5.2/Viz/PanelreferenceforSimplifiedXML#table

Re: How can I add a summary row to a table in Simple XML

helge — Wed, 29 Mar 2017 23:57:47 GMT

Awesome, thanks for the quick answer. It seems this really was not documented!

Re: How can I add a summary row to a table in Simple XML

helge — Wed, 29 Mar 2017 23:58:55 GMT

Thanks for the quick update to the docs! One thing I would still like to know: what is the first Splunk version to support that?
I am asking because we need to support older versions with our apps.

Re: How can I add a summary row to a table in Simple XML

helge — Thu, 30 Mar 2017 00:00:24 GMT

@niketnilay Why don't you convert your comment into an answer so I can mark it as correct?

Re: How can I add a summary row to a table in Simple XML

woodcock — Thu, 30 Mar 2017 03:01:49 GMT

I didn't even know that such a thing was there; I will definitely be using that!

Re: How can I add a summary row to a table in Simple XML

niketn — Thu, 30 Mar 2017 08:50:14 GMT

@woodcock @helge... I generally use the Splunk Overview App launched with latest release of Splunk to pick up what's new in it for us.

Splunk Enterprise 6.5 Overview App link: https://splunkbase.splunk.com/app/3287/

Re: How can I add a summary row to a table in Simple XML

niketn — Thu, 30 Mar 2017 09:47:03 GMT

@helge... Good to know that the answer helped. Do check out Splunk Enterprise 6.5 Overview App on Splunkbase which also has this feature document. This probably also answers your other question for version support.

Re: How can I add a summary row to a table in Simple XML

frobinson_splun — Thu, 30 Mar 2017 17:58:43 GMT

Version 6.5 was the first version, coinciding with the UI instructions for adding summary rows that appeared in our 6.5 docs. Thanks for asking.

Re: How can I add a summary row to a table in Simple XML

eggieboylaqui — Tue, 08 May 2018 03:14:46 GMT

How can we add label Total on that row? Thank you.

Re: How can I add a summary row to a table in Simple XML

eggieboylaqui — Tue, 08 May 2018 03:15:01 GMT

How can we add label Total on that row? Thank you.

Re: How can I add a summary row to a table in Simple XML

niketn — Tue, 08 May 2018 05:13:14 GMT

@eggieboylaqui for Table Summary Row, the Label Total can be added using JavaScript with Splunk JS Stack and jQuery Selector, similar to my answer https://answers.splunk.com/answers/593405/drill-down-for-cell.html

Other option for you would be to use addcoltotals or addtoals command with label and labelfield arguments to show Total Label.

Following is a run anywhere dashboard example with both approach:

<dashboard script="table_summary_row_label.js">
  <label>Summary Total Row with Label</label>
  <row>
    <panel>
      <title>Option 1: Summary Row</title>
      <table id="tableWithTotalRow">
        <search>
          <query>index=_internal sourcetype=splunkd log_level=*
| chart count by log_level component limit=5 useother=f</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="count">20</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">none</option>
        <option name="percentagesRow">false</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">true</option>
        <option name="wrap">true</option>
      </table>
    </panel>
  </row>
  <row>
    <panel>
      <title>Option 2: Add Total</title>
      <table>
        <search>
          <query>index=_internal sourcetype=splunkd log_level=*
| chart count by log_level component limit=5 useother=f
| addcoltotals labelfield="log_level" label="Total"</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="count">20</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">none</option>
        <option name="percentagesRow">false</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
      </table>
    </panel>
  </row>
</dashboard>

Following is the required JavaScript code table_summary_row_label.js, which would need to be placed under appserver/static folder (typically $SPLUNK_HOME/etc/apps/appserver/<yourAppName>/appserver/static).
PS: If the folder does not exist it would need to be created. Also, since this option requires JavaScript static file, it might require Splunk restart and clearing of internet browser history.

require([
    'underscore',
    'jquery',
    'splunkjs/mvc',
    'splunkjs/mvc/tableview',
    'splunkjs/mvc/simplexml/ready!'
], function(_, $, mvc, TableView) {
    mvc.Components.get("tableWithTotalRow").getVisualization(function(tableView) {
        tableView.on('rendered', function() {
            setTimeout(function(){
                $("div#tableWithTotalRow table tbody tr.shared-resultstable-resultstablesummaryrow td.null").html("Total");
            },100);
        });
    });
});

Re: How can I add a summary row to a table in Simple XML

eggieboylaqui — Tue, 08 May 2018 05:13:15 GMT

How can we add label Total on that row? Thank you.

Re: How can I add a summary row to a table in Simple XML

eggieboylaqui — Tue, 08 May 2018 05:50:19 GMT

Thanks for the help, will try this one.

Re: How can I add a summary row to a table in Simple XML

shariinPH — Wed, 30 Sep 2020 05:34:36 GMT

This has been a big help.

however the summary row total is not included on the extract table when clicking download/export button on the table. Does anyone know how to solve this?

Re: How can I add a summary row to a table in Simple XML

niketn — Wed, 30 Sep 2020 06:01:44 GMT

@shariinPH use Option 2 with addtotals command which should work for you!

Re: How can I add a summary row to a table in Simple XML

jakubvojacek — Wed, 02 Jun 2021 16:08:35 GMT

Hello @niketn

is there a possibility to add a total column but not using addtotals command
As I would like to use Data overlay: heatMap
And with addtotals it is not very usable (Total column is most red)
Or I am not understanding heatmap overlay correctly