Hi, I am creating a report with "chart field1 field2", field2 only has 2 values. So the result has 3 columns: Field1, Field2Value1, Field2Value2. And I'd like to use addtotals and addcoltotals for each row and each column.
The issue I am having now, is that value of field1 are numbers so they are counted by both addtotals and addcoltotals, which I don't want.
I believe the easiest way is to convert the type of Field1 to string, with certain format, like number "12345" to string "12345", number "123" to "00123". I have tried tostring. But they are still counted.
Hi @AllenZhang,
Use the file name after the addcoltotals commands to calculate the totals only for the specified column.
<your query>
|table field1,field2,field3
|addcoltotals field2 field3
The above query will calculate the column totals for field2 and field3 only.
Hi impurush,
Thanks for your reply!
I've also found this "work-around" solution. I actually added "col=true" which adds a row of total for the listed column as well. Good enough for what I need.
Still hard to believe why it's so hard to convert number to string in Splunk, which is much easier in other places, like Excel, Powershell, etc.
Thanks
Allen