AddColTotals & Percentage Column

[behymejt2012]

Hi Everyone,

I have an existing table that includes several columns filled with numeric values and one column that creates percentage based off several of the existing columns. When adding in addcoltotals at the end of the statement, it adds the numeric columns correctly, but it adds all the percentage column values together.

Is there a way to have that addcoltotals percentage column be an average percentage total instead of an overall sum of all percentage?

[gcusello]

Hi behymejt2012,
using addcoltotals command you can specify the field list that you want to summarize

see the example in Splunk Documentation page http://docs.splunk.com/Documentation/Splunk/6.5.0/SearchReference/Addcoltotals

sourcetype=access_* | table userId bytes avgTime duration | addcoltotals bytes duration

Bye.
Giuseppe

[Kyle_Jackson]

Figured it out, I had the same problem.
Add all the columns EXCEPT for the percentage column.
You should now have all totals except for the percentage column.
Do an eval looking for the null percentage column and calculate the percentage.

   ... | yoursearch | addcoltotals twomonth_job_failures twomonth_job_runs labelfield="myfield" | eval OneMonthPercentage=if(isnull(OneMonthPercentage), round((twomonth_job_failures/twomonth_job_runs)*100,2) , OneMonthPercentage)

[lguinn2]

You can't do that with addcoltotals. However, you can do something like this

yoursearchhere
| addcoltotals field1 field2 field3

where field1 field2 field3 is a list of the fields that you want to total.

[demkic]

Hi there,
Is there a way that I can divide the values from field1 by the column total of field1 and display in a new field4? thank you