Splunk Search
Highlighted

Adding column total in new row

Explorer

Hi,
I have a data set like

Col A Col B
Time 5
Time 5
.
.

I want a new row with the total of Column B, something like

Col A Col B
Time 5
Time 5
Total 10

i know we can use addcoltotals but that adds a new column label.
Some input appreciated.
Thanks

Tags (1)
Highlighted

Re: Adding column total in new row

Explorer

yeah .. tried that as well .. but that too gives output something like

Col A Col B
Time 5
Time 5
10

I need to show the Total Alias in the last row

0 Karma
Highlighted

Re: Adding column total in new row

Contributor

Take a look at the following. I am filling in the word Total in the endhuman column at the end.

|gentimes start=-2 |fillnull value="blank" endhuman|addcoltotals|fillnull value="Total" endhuman|table endhuman,starttime,endtime,starthuman

View solution in original post

Highlighted

Re: Adding column total in new row

Explorer

Thanks Reed ... That worked ... 🙂

0 Karma
Highlighted

Re: Adding column total in new row

Splunk Employee
Splunk Employee

Another way to get a column total, but it will be for each lines.

<mysearch> | table colA colB | eventstats sum(colB) AS total

Highlighted

Re: Adding column total in new row

Explorer

Try | addcolTotals