I have an existing table that includes several columns filled with numeric values and one column that creates percentage based off several of the existing columns. When adding in addcoltotals at the end of the statement, it adds the numeric columns correctly, but it adds all the percentage column values together.
Is there a way to have that addcoltotals percentage column be an average percentage total instead of an overall sum of all percentage?
using addcoltotals command you can specify the field list that you want to summarize
see the example in Splunk Documentation page http://docs.splunk.com/Documentation/Splunk/6.5.0/SearchReference/Addcoltotals
sourcetype=access_* | table userId bytes avgTime duration | addcoltotals bytes duration
Figured it out, I had the same problem.
Add all the columns EXCEPT for the percentage column.
You should now have all totals except for the percentage column.
Do an eval looking for the null percentage column and calculate the percentage.
... | yoursearch | addcoltotals twomonth_job_failures twomonth_job_runs labelfield="myfield" | eval OneMonthPercentage=if(isnull(OneMonthPercentage), round((twomonth_job_failures/twomonth_job_runs)*100,2) , OneMonthPercentage)
You can't do that with addcoltotals. However, you can do something like this
yoursearchhere | addcoltotals field1 field2 field3
field1 field2 field3 is a list of the fields that you want to total.