Splunk Search

Adding column total in new row

dutabhis07
Explorer

Hi,
I have a data set like

Col A Col B
Time 5
Time 5
.
.

I want a new row with the total of Column B, something like

Col A Col B
Time 5
Time 5
Total 10

i know we can use addcoltotals but that adds a new column label.
Some input appreciated.
Thanks

Tags (1)
1 Solution

reed_kelly
Contributor

Take a look at the following. I am filling in the word Total in the endhuman column at the end.

|gentimes start=-2 |fillnull value="blank" endhuman|addcoltotals|fillnull value="Total" endhuman|table endhuman,starttime,endtime,starthuman

View solution in original post

ViniciusANT
Explorer

Try | addcolTotals

yannK
Splunk Employee
Splunk Employee

Another way to get a column total, but it will be for each lines.

<mysearch> | table colA colB | eventstats sum(colB) AS total

reed_kelly
Contributor

Take a look at the following. I am filling in the word Total in the endhuman column at the end.

|gentimes start=-2 |fillnull value="blank" endhuman|addcoltotals|fillnull value="Total" endhuman|table endhuman,starttime,endtime,starthuman

dutabhis07
Explorer

Thanks Reed ... That worked ... 🙂

0 Karma

dutabhis07
Explorer

yeah .. tried that as well .. but that too gives output something like

Col A Col B
Time 5
Time 5
10

I need to show the Total Alias in the last row

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Where Innovation Takes Flight: The Splunk4Aviation Flight Sim Lands at .conf26

If you hear someone at .conf26 shouting "gear down, GEAR DOWN" across the show floor, you have found us.  The ...

Turn Cisco Telemetry Into Action with Cisco Data Fabric, powered by the Splunk ...

The surge in machine data is already hitting enterprise budgets, and the agentic era will only intensify it. ...

Persistent Queue at TcpOut — One of Splunk's Most Practical Features

Splunk introduced persistent queueing at the tcpout layer as one of the most practical resilience features in ...