I would appreciate any comments:
1) Added "Total" as one of my Selected Fields from the following search (this worked fine):
host="HP" sourcetype="csv" | eval ActionObligation1=tonumber(replace(ActionObligation,",","")) | eventstats sum(ActionObligation1) as Total | eval Total=if(Total>0,"$".tostring(Total,"commas"),"($".tostring(Total*-1,"commas").")")
2) Then I changed "Total" to "GrandTotal" and forgot to remove the previous "Total" from Selected Fields
host="HP" sourcetype="csv" | eval ActionObligation1=tonumber(replace(ActionObligation,",","")) | eventstats sum(ActionObligation1) as GrandTotal | eval GrandTotal=if(GrandTotal>0,"$".tostring(GrandTotal,"commas"),"($".tostring(GrandTotal*-1,"commas").")")
3) I then unchecked all Selected Fields
4) How do I get GrandTotal to appear in Interesting Fields? It no longer displays as an interesting new field. I tried changing back to Total and it no longer displays it under Interesting fields either.
Interesting fields
are fields that have values in over 20% of the events that are returned from your search. The amount of fields you see in interesting fields can also depend on your search mode (fast mode does not perform field discovery). If you go to "All Fields", you can then search for your field or change the threshold. From there, you can also make the field selected, even if it isn't considered an "interesting" field.
Interesting fields
are fields that have values in over 20% of the events that are returned from your search. The amount of fields you see in interesting fields can also depend on your search mode (fast mode does not perform field discovery). If you go to "All Fields", you can then search for your field or change the threshold. From there, you can also make the field selected, even if it isn't considered an "interesting" field.
"All Fields" do not show the "GrandTotal" . Coverage option is 100%. if fast mode does not perform field discovery
why did "Total" showed before but it no longer shows up under interesting fields? There are over 8,000 events returned from the search. Perhaps something got changed and I need to reset my splunk environment. Thanks!
I think I see my issue. Coverage option should be changed to "All Fields". Now I can see "GrandTotal"! Thanks!