Splunk Search

Adding column total in new row

dutabhis07
Explorer

Hi,
I have a data set like

Col A Col B
Time 5
Time 5
.
.

I want a new row with the total of Column B, something like

Col A Col B
Time 5
Time 5
Total 10

i know we can use addcoltotals but that adds a new column label.
Some input appreciated.
Thanks

Tags (1)
1 Solution

reed_kelly
Contributor

Take a look at the following. I am filling in the word Total in the endhuman column at the end.

|gentimes start=-2 |fillnull value="blank" endhuman|addcoltotals|fillnull value="Total" endhuman|table endhuman,starttime,endtime,starthuman

View solution in original post

ViniciusANT
Explorer

Try | addcolTotals

yannK
Splunk Employee
Splunk Employee

Another way to get a column total, but it will be for each lines.

<mysearch> | table colA colB | eventstats sum(colB) AS total

reed_kelly
Contributor

Take a look at the following. I am filling in the word Total in the endhuman column at the end.

|gentimes start=-2 |fillnull value="blank" endhuman|addcoltotals|fillnull value="Total" endhuman|table endhuman,starttime,endtime,starthuman

dutabhis07
Explorer

Thanks Reed ... That worked ... 🙂

0 Karma

dutabhis07
Explorer

yeah .. tried that as well .. but that too gives output something like

Col A Col B
Time 5
Time 5
10

I need to show the Total Alias in the last row

0 Karma
Get Updates on the Splunk Community!

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...

🔐 Trust at Every Hop: How mTLS in Splunk Enterprise 10.0 Makes Security Simpler

From Idea to Implementation: Why Splunk Built mTLS into Splunk Enterprise 10.0  mTLS wasn’t just a checkbox ...

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...