addtotals result move to the top row

[viktoriiants]

The query produces multiple pages of results. How do I move the total to the top (first) row for convenience?

search query | eval dayOfWeek=strftime(_time, "%A"), date=strftime(_time, "%Y-%m-%d") | eval dayNum=case(dayOfWeek=="Sunday", 1, dayOfWeek=="Monday", 2, dayOfWeek=="Tuesday", 3, dayOfWeek=="Wednesday", 4, dayOfWeek=="Thursday", 5, dayOfWeek=="Friday", 6, dayOfWeek=="Saturday", 7) | stats count as "Session count" by dayOfWeek, date | addtotals col=t row=f label="Month total" |sort date desc

[danspav · Accepted solution]

Hi @viktoriiants.,

How about something like this:

index=_internal 
| eval dayOfWeek=strftime(_time, "%A"), date=strftime(_time, "%Y-%m-%d") 
| eval dayNum=tonumber(strftime(_time,"%w")) + 1 ``` 1=Sunday, ..., 7=Saturday```
| stats count as "Session count" by dayOfWeek, date 
| addtotals col=t row=f
| eval sort = if(isnull(date),1,0)
| sort - sort + date 
| fields - sort

Here we're creating a new temporary field to sort on, where we set it to 1 for our total row, and 0 for all other rows. Then we sort by this column and the date column. Finally, we remove the "sort" column.

[viktoriiants]

Thank you! It did help 

[meetmshah]

Hello, Just checking through if the issue was resolved or you have any further questions? 

[viktoriiants]

Thank you

[meetmshah]

Hello @viktoriiants, How about sorting it by 'Session count' before date desc?