Splunk Enterprise

How to add column values ?

Muthu_Vinith
Path Finder




0 Karma

richgalloway
SplunkTrust
SplunkTrust

Try the addcoltotals command.

<<your current query>>
| addcoltotals labelfield=location label="AM05"

 

---
If this reply helps you, Karma would be appreciated.
0 Karma

Muthu_Vinith
Path Finder

Is there any other ways like using eval, append commands? @richgalloway 

0 Karma

richgalloway
SplunkTrust
SplunkTrust

There's almost always more than one way to do something in SPL, but why take the hard road?

<<your current search>>
| appendpipe 
    [stats sum(cap) as cap, sum(login) as login 
    | eval location="AM05"]
---
If this reply helps you, Karma would be appreciated.
0 Karma

Muthu_Vinith
Path Finder

@richgalloway I've tried this command it works. However if I need to filter out specific locations like AB AC and AD, sum their values to a new location let's say AM05. When I search for AM05 , it should display the summed value. If i search for AB, it should show the existing value. Is it possible? 

0 Karma

richgalloway
SplunkTrust
SplunkTrust

I don't understand these new requirements.  If AB is filtered out then it cannot be searched.  You cannot search for AM05 since it doesn't exist until the appendpipe command runs.

What is the final result expected to look like?

---
If this reply helps you, Karma would be appreciated.
0 Karma

Muthu_Vinith
Path Finder

For example, I have location field containing AB, AC, AD. I need to sum these three locations and create a new location named AM05,  without replacing the existing AB, AC and AD. When searching for AM05, I want to see the added values, and when searching for AB, it should display the existing value !! @richgalloway 

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Restating the requirements does not explain them.


@Muthu_Vinith wrote:

For example, I have location field containing AB, AC, AD. I need to sum these three locations and create a new location named AM05,  without replacing the existing AB, AC and AD.

You have that.  See the following example query

 

| makeresults format=csv data="location,cap,login 
AA01,10,5
AB02,6,0
AC03,10,0"
| appendpipe 
    [stats sum(cap) as cap, sum(login) as login 
    |  eval location="AM05"]
| table location cap login

@Muthu_Vinith wrote:

When searching for AM05, I want to see the added values, and when searching for AB, it should display the existing value !!


The AM05 location doesn't exist until this search runs.  Therefore, you can't search for AM05.

 

---
If this reply helps you, Karma would be appreciated.
0 Karma

Muthu_Vinith
Path Finder

@richgalloway  Sorry I got confused. I'll say my exact requirements . In my location field there some locations
AB
AC
AD
AF
and so on. I want new one which is AM in location field where AM indicates the addition of (AB AC AD AF). 
I want to display both AB AC AD AF and AM in the location field.

Don't consider this 
AA01,10,5 

I tried something like this
|eval row=AM05
|table row location
where it will show AM05 for all fields. But i want only for addition of (AB AC AD AF) which is AM05 . without replacing existing ones that is (AB AC AD AF).

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| append [| makeresults | eval location="AM"]
0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...