Splunk Search

Addcoltotals Command Issue

manpreetsingh29
Loves-to-Learn Lots

Hi Splunkers,

I am facing weird issue with addcoltotals command. While it is working perfectly fine if i open a new search tab but once i add the same query in Dashboard it is breaking down. I am trying to run the command in SplunkDB connect. Below is the snippet for reference.

Not working-After_Adding_to_Dashboard.png
Working Fine.png

Below is the query

index=db_connect_dev_data
|rename PROCESS_DT as Date
| table OFFICE,Date,MOP,Total_Volume,Total_Value
| search OFFICE=GB1
|eval _time=strptime(Date,"%Y-%m-%d")
|addinfo
|eval info_min_time=info_min_time-3600,info_max_time=info_max_time-3600
|where _time>=info_min_time AND _time<=info_max_time
|table Date,MOP,OFFICE,Total_Volume,Total_Value
| addcoltotals "Total_Volume" "Total_Value" label=Total_GB1 labelfield=MOP
|filldown
| eval Total_Value_USD=Total_Value/1000000
| eval Total_Value_USD=round(Total_Value_USD,5)
| stats sum(Total_Volume) as "Total_Volume",sum("Total_Value_USD") as Total_Value(mn) by MOP
|search MOP=*
|table MOP,Total_Volume,Total_Value(mn)



Let me know if anyone know why it is happening,

Labels (1)
0 Karma

yuanliu
SplunkTrust
SplunkTrust

addtotals is the wrong tool for what you wanted. (It is really bad to use screenshot to illustrate text output.  Always use text unless you are illustrating a visual effect.)  addcoltotals is what you need.

| addcoltotals labelfield=MOP
Tags (1)
0 Karma

manpreetsingh29
Loves-to-Learn Lots

Mean to say not getting the required result.You can find the same in the snippet attached.

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Try without the penultimate search

|search MOP=*

It isn't necessary as stats by MOP effectively does the same thing i.e. you will only get stats for non-null values of MOP which is what the search is doing as well

0 Karma

manpreetsingh29
Loves-to-Learn Lots

Still facing the same issue. It is intermittent sometime it is working and sometime not.I should get Total_GB1 and total of all column but instead i am getting 18 in place of Total_GB1 and penultimate value is getting printed in 18.

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

What do you mean by "breaking down"?

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...