Addcoltotals Command Issue

[manpreetsingh29]

Hi Splunkers,

I am facing weird issue with addcoltotals command. While it is working perfectly fine if i open a new search tab but once i add the same query in Dashboard it is breaking down. I am trying to run the command in SplunkDB connect. Below is the snippet for reference.




Below is the query

index=db_connect_dev_data
|rename PROCESS_DT as Date
| table OFFICE,Date,MOP,Total_Volume,Total_Value
| search OFFICE=GB1
|eval _time=strptime(Date,"%Y-%m-%d")
|addinfo
|eval info_min_time=info_min_time-3600,info_max_time=info_max_time-3600
|where _time>=info_min_time AND _time<=info_max_time
|table Date,MOP,OFFICE,Total_Volume,Total_Value
| addcoltotals "Total_Volume" "Total_Value" label=Total_GB1 labelfield=MOP
|filldown
| eval Total_Value_USD=Total_Value/1000000
| eval Total_Value_USD=round(Total_Value_USD,5)
| stats sum(Total_Volume) as "Total_Volume",sum("Total_Value_USD") as Total_Value(mn) by MOP
|search MOP=*
|table MOP,Total_Volume,Total_Value(mn)

Let me know if anyone know why it is happening,

[yuanliu]

addtotals is the wrong tool for what you wanted. (It is really bad to use screenshot to illustrate text output.  Always use text unless you are illustrating a visual effect.)  addcoltotals is what you need.

| addcoltotals labelfield=MOP

[manpreetsingh29]

Mean to say not getting the required result.You can find the same in the snippet attached.

[ITWhisperer]

Try without the penultimate search

|search MOP=*

It isn't necessary as stats by MOP effectively does the same thing i.e. you will only get stats for non-null values of MOP which is what the search is doing as well

[manpreetsingh29]

Still facing the same issue. It is intermittent sometime it is working and sometime not.I should get Total_GB1 and total of all column but instead i am getting 18 in place of Total_GB1 and penultimate value is getting printed in 18.

[ITWhisperer]

What do you mean by "breaking down"?