Splunk Search

How to append column total to column name?

sandeepmakkena
Contributor

I have data something like this

Name. Accepted Rejected Posted Total

Change 3 5 7 15
NOC 5 6 5 16
8 11 12 21

Which I am getting by this command

Index=#####
| chart dc(TID) as count by Name Status
| addtotals 
| addcolTotals

What I wanted is
Name. Accepted(8) Rejected(11) Posted(12) Total(21)

Change 3 5 7 15
NOC 5 6 5 16
8 11 12 21
I did try | eval status=status."(".count.")"
Thanks for your time!

1 Solution

woodcock
Esteemed Legend

Here is a run-anywhere example that does it:

index=_* 
| rename component AS Status, sourcetype AS Name
| chart useother=f usenull=f limit=3 count BY Name Status 

| rename COMMENT AS "Everything above generates sample event data; everything below is your solution"

| addtotals row=t col=t
| eval Name=coalesce(Name, "Grand Totals")
| rename Name AS _Name
| eventstats max(*) AS total_*
| foreach total_* [ eval <<FIELD>> = "<<MATCHSTR>>(" . <<FIELD>> . ")", {<<FIELD>>} = <<MATCHSTR>> | fields - <<FIELD>> <<MATCHSTR>> ]
| rename _Name AS Name

View solution in original post

0 Karma

woodcock
Esteemed Legend

Here is a run-anywhere example that does it:

index=_* 
| rename component AS Status, sourcetype AS Name
| chart useother=f usenull=f limit=3 count BY Name Status 

| rename COMMENT AS "Everything above generates sample event data; everything below is your solution"

| addtotals row=t col=t
| eval Name=coalesce(Name, "Grand Totals")
| rename Name AS _Name
| eventstats max(*) AS total_*
| foreach total_* [ eval <<FIELD>> = "<<MATCHSTR>>(" . <<FIELD>> . ")", {<<FIELD>>} = <<MATCHSTR>> | fields - <<FIELD>> <<MATCHSTR>> ]
| rename _Name AS Name
0 Karma

sandeepmakkena
Contributor

This is wonderful @woodcock, Thanks for your help!

kamlesh_vaghela
SplunkTrust
SplunkTrust

@sandeepmakkena

Can you please try this?

 Index=#####
 | chart dc(TID) as count by Name Status
 | addtotals 
| table Name Accepted Rejected Posted Total | addcolTotals labelfield=Name label="my_total" | transpose header_field=Name | eval column=column."(".my_total.")" | transpose header_field=column  | rename column as Name

Sample Search:

| makeresults | eval _raw="Name Accepted Rejected Posted Total
Change 3 5 7 15
NOC 5 6 5 16" | multikv | table Name Accepted Rejected Posted Total | addcolTotals labelfield=Name label="my_total" | transpose header_field=Name | eval column=column."(".my_total.")" | transpose header_field=column  | rename column as Name

Note: You can remove | table Name Accepted Rejected Posted Total if the sequence of fields is the same.

0 Karma

sandeepmakkena
Contributor

@kamlesh_vaghela Thanks for responding but, it does not work.

I am getting something like this.

Name row 1 row 2 row 3
AE 2 0 2
AT 5 0 6
AU 2 0 3
BE 6 0 6
BR 24 0 31

I already tried something similar, I think I am missing something, Thanks!

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...