Convert number to string, to avoid being counted by addtotals/addcoltotals

[AllenZhang]

Hi, I am creating a report with "chart field1 field2", field2 only has 2 values. So the result has 3 columns: Field1, Field2Value1, Field2Value2. And I'd like to use addtotals and addcoltotals for each row and each column.

The issue I am having now, is that value of field1 are numbers so they are counted by both addtotals and addcoltotals, which I don't want.

I believe the easiest way is to convert the type of Field1 to string, with certain format, like  number "12345"  to string "12345", number "123" to "00123". I have tried tostring. But they are still counted.

[impurush]

Hi @AllenZhang,

Use the file name after the addcoltotals commands to calculate the totals only for the specified column.

<your query>
|table field1,field2,field3
|addcoltotals field2 field3

The above query will calculate the column totals for field2 and field3 only.

[AllenZhang]

Hi impurush,

Thanks for your reply!
I've also found this "work-around" solution.  I actually added "col=true" which adds a row of total for the listed column as well. Good enough for what I need.

Still hard to believe why it's so hard to convert number to string in Splunk, which is much easier in other places, like Excel, Powershell, etc.

Thanks

Allen