Dashboards & Visualizations

How to move addtotals to the first column for a chart?

MeMilo09
Path Finder

Hello Splunk Community,

How can I move the addtotals field to display as the first column and not last for this chart? 

Currently: 

_timeHost123Host456total 
2022-02-24 22:00022


Would like:

_timetotalHost123Host456
2022-02-24 22:00202



Current Code:

 index="Dept_data_idx"  eventType="Created" status="success" host=* | bucket _time span=1h | stats  count by _time host | addtotals
Labels (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

You didn't show it as using chart, you showed using stats. For chart, use this

index="Dept_data_idx"  eventType="Created" status="success" host=* | bucket _time span=1h | chart count by _time host | addtotals
| table _time Total *

View solution in original post

0 Karma

SanjayReddy
SplunkTrust
SplunkTrust

hi @MeMilo09 

Updated Answer 

you can use table command to re arrange the fields

index="Dept_data_idx" eventType="Created" status="success" host=*
| bucket _time span=1h
| stats count by _time host
| addtotals
| table Total _time host

also if you want to rename the total name which is default name  use following after addtotals 

fieldname="Total by Row" to rename the column name (Total is default) 

0 Karma

MeMilo09
Path Finder

Thanks, but doing | table command does not fix the issue, since I am using | chart command. When I use | table I am able to move the addtotals column to the start of the table, but it does away with the host data. So what I get now looks like this using table... notice no host name or counts are under the host now. 

_timeTotalhost
2022-02-24 22:004 
2022-02-24 23:002 
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

You didn't show it as using chart, you showed using stats. For chart, use this

index="Dept_data_idx"  eventType="Created" status="success" host=* | bucket _time span=1h | chart count by _time host | addtotals
| table _time Total *
0 Karma

MeMilo09
Path Finder

Yes, I needed to keep the chart at all costs

| table  _time Total * 

did it and I totally understand why now.

Thanks!

0 Karma

SanjayReddy
SplunkTrust
SplunkTrust

Hi @ITWhisperer 

My bad, missed that😀

Thanks for let me know 😄

SanjayReddy
SplunkTrust
SplunkTrust

Hi @MeMilo09 

I updated My initlal repsone, can you please use that query

Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...