AddColTotal value in a new column

[zacksoft]

I use addcoltotal for one of my columns .
But my result has a lot of rows, so I have to browse a lot of pages to find my sum result at the bottom.
Can we have the sum/result in a new column instead ?

[mayurr98 · Accepted solution]

Hey @zacksoft

As per your comments you want total of third column in the new column right?
Let suppose your third column name is third_column

Then your query will be

Your base search with all 5 columns | eventstats sum(third_column) as total 

After this you will get the total which will be reflected at every line in the new column called total

Another solution is if you are just interested in total
Then try this

Your base search will all 5 columns | addcoltotals third_column | tail 1

Let me know if this helps you!

[mayurr98]

hey, @zacksoft have you tried above two queries?

[zacksoft]

I'm trying this now.

[zacksoft]

Hi @mayurr98,

I tried both the queries , both works . I am more interested towards the first query.
The only thing is, it shows the sum of third row in a newly created column called total "in every row".
Is it possible to have the sum only in the first row ?

[mayurr98]

hey, you can show it using appendcols command but it will take longer to run.
Try this !

Your base search with all 5 columns | appendcols [Your base search with all 5 columns  | eventstats sum(third_column) as total | head 1]

otherwise, i do not think any other solution for this!
let me know if this helps you!

[risgupta]

you can try
| addtotals col=t row=f


Let me know if that helps you.

[zacksoft]

I have 5 columns.
I need to calculate the total of the third column only.
And instead of seeing the total of it at the bottom of the result, I want to see it , say on the first row of a newly created sixth column called Sum_calculated.

[risgupta]

I think this answer can help your query
https://answers.splunk.com/answers/478795/how-to-append-columns-based-on-searches-and-row-va.html

Please check the same.

[zacksoft]

I have 5 columns.
I need to calculate the total of the third column only.
And instead of seeing the total of it at the bottom of the result, I want to see it , say on the first row of a newly created sixth column called Sum_calculated.