Dashboards & Visualizations

How to move addtotals to the first column for a chart?

MeMilo09
Path Finder

Hello Splunk Community,

How can I move the addtotals field to display as the first column and not last for this chart? 

Currently: 

_timeHost123Host456total 
2022-02-24 22:00022


Would like:

_timetotalHost123Host456
2022-02-24 22:00202



Current Code:

 index="Dept_data_idx"  eventType="Created" status="success" host=* | bucket _time span=1h | stats  count by _time host | addtotals
Labels (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

You didn't show it as using chart, you showed using stats. For chart, use this

index="Dept_data_idx"  eventType="Created" status="success" host=* | bucket _time span=1h | chart count by _time host | addtotals
| table _time Total *

View solution in original post

0 Karma

SanjayReddy
Builder

hi @MeMilo09 

Updated Answer 

you can use table command to re arrange the fields

index="Dept_data_idx" eventType="Created" status="success" host=*
| bucket _time span=1h
| stats count by _time host
| addtotals
| table Total _time host

also if you want to rename the total name which is default name  use following after addtotals 

fieldname="Total by Row" to rename the column name (Total is default) 

0 Karma

MeMilo09
Path Finder

Thanks, but doing | table command does not fix the issue, since I am using | chart command. When I use | table I am able to move the addtotals column to the start of the table, but it does away with the host data. So what I get now looks like this using table... notice no host name or counts are under the host now. 

_timeTotalhost
2022-02-24 22:004 
2022-02-24 23:002 
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

You didn't show it as using chart, you showed using stats. For chart, use this

index="Dept_data_idx"  eventType="Created" status="success" host=* | bucket _time span=1h | chart count by _time host | addtotals
| table _time Total *
0 Karma

MeMilo09
Path Finder

Yes, I needed to keep the chart at all costs

| table  _time Total * 

did it and I totally understand why now.

Thanks!

0 Karma

SanjayReddy
Builder

Hi @ITWhisperer 

My bad, missed that😀

Thanks for let me know 😄

SanjayReddy
Builder

Hi @MeMilo09 

I updated My initlal repsone, can you please use that query