How to move addtotals to the first column for a chart?

[MeMilo09]

Hello Splunk Community,

How can I move the addtotals field to display as the first column and not last for this chart? 

Currently: 

_time	Host123	Host456	total
2022-02-24 22:00	0	2	2

Would like:

_time	total	Host123	Host456
2022-02-24 22:00	2	0	2

Current Code:

 index="Dept_data_idx"  eventType="Created" status="success" host=* | bucket _time span=1h | stats  count by _time host | addtotals

[SanjayReddy]

hi @MeMilo09 

Updated Answer 

you can use table command to re arrange the fields

index="Dept_data_idx" eventType="Created" status="success" host=*
| bucket _time span=1h
| stats count by _time host
| addtotals
| table Total _time host

also if you want to rename the total name which is default name  use following after addtotals 

fieldname="Total by Row" to rename the column name (Total is default) 

[MeMilo09]

Thanks, but doing | table command does not fix the issue, since I am using | chart command. When I use | table I am able to move the addtotals column to the start of the table, but it does away with the host data. So what I get now looks like this using table... notice no host name or counts are under the host now. 

_time	Total	host
2022-02-24 22:00	4
2022-02-24 23:00	2

[ITWhisperer · Accepted solution]

You didn't show it as using chart, you showed using stats. For chart, use this

index="Dept_data_idx"  eventType="Created" status="success" host=* | bucket _time span=1h | chart count by _time host | addtotals
| table _time Total *

[MeMilo09]

Yes, I needed to keep the chart at all costs

| table  _time Total * 

did it and I totally understand why now.

Thanks!

[SanjayReddy]

Hi @ITWhisperer 

My bad, missed that😀

Thanks for let me know 😄

[SanjayReddy]

Hi @MeMilo09 

I updated My initlal repsone, can you please use that query