Adding a column

[Muthu_Vinith]

Hi Splunk experts,

I’m a Splunk beginner. I need help with a requirement. I have fields named 'location,' 'login,' and 'desk' with the following values:

location  login  desk

AA             1       0

BB             1       0

CC             0       10

DD             1       1

EE             0       1

My goal is to create a new location called 'ABC,' which should be the sum of all four locations (AA, BB, CC, DD). I've tried the following search, but it's not summing up all four locations:

| appendpipe [search AA BB CC DD | eval location=“ABC”]

| stats sum(login) as login by desk

Please guide me on how to achieve this. Thank you.

[ITWhisperer]

Please clarify your question - you say you want to add a column but appendpipe will add row(s) - you  have 5 locations not 4, do you wish to exclude a particular location or sum the logins for all locations by desk?

[richgalloway]

Use the addcoltotals command to sum the values and put them into the location field as "ABC".

... | addcoltotals labelfield=location label="ABC"