Archive
Highlighted

AddColTotals

Contributor

Hi, I want to get the count of errors. So i have a query to get the count by status where status is greater than 400. When i use addcoltotals, it is thinking status as a column and hence it is giving the total for both. How can i get that?

/Current
No status count
1 200 26
2 302 57
3 502 83

Expected

No status count
1 200 26
2 302 57
3 Total 83

sourcetype=accesscombinedwcookie host="qqqq" uri=/checklogin status>400 | stats count by status | addcoltotals label=Total labelfield=status

Tags (1)
0 Karma
Highlighted

Re: AddColTotals

Motivator

I don't think it's possible to exclude with addColTotals, but you should be able to with addTotals. Here's the documentation: http://docs.splunk.com/Documentation/Splunk/5.0.3/SearchReference/Addtotals

Your search would look like this:
sourcetype=accesscombinedwcookie host="qqqq" uri=/checklogin status>400 | stats count by status | addTotals col=t label=Total labelfield=status count

0 Karma
Highlighted

Re: AddColTotals

Communicator

You should be able to just name the fields you want totals for.

sourcetype=access_combined_wcookie host="qqqq" uri=/checklogin status>400 | stats count by status | addcoltotals count label=Total labelfield=status

View solution in original post

Highlighted

Re: AddColTotals

Contributor

Thank you !!! This worked fine.

0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.