Splunk Search

Convert number to string, to avoid being counted by addtotals/addcoltotals

AllenZhang
Explorer

Hi, I am creating a report with "chart field1 field2", field2 only has 2 values. So the result has 3 columns: Field1, Field2Value1, Field2Value2. And I'd like to use addtotals and addcoltotals for each row and each column.

The issue I am having now, is that value of field1 are numbers so they are counted by both addtotals and addcoltotals, which I don't want.

I believe the easiest way is to convert the type of Field1 to string, with certain format, like  number "12345"  to string "12345", number "123" to "00123". I have tried tostring. But they are still counted.

 

Labels (2)
Tags (1)
0 Karma

impurush
Contributor

Hi @AllenZhang,

Use the file name after the addcoltotals commands to calculate the totals only for the specified column.

<your query>
|table field1,field2,field3
|addcoltotals field2 field3

The above query will calculate the column totals for field2 and field3 only.

0 Karma

AllenZhang
Explorer

Hi impurush,

Thanks for your reply!
I've also found this "work-around" solution.  I actually added "col=true" which adds a row of total for the listed column as well. Good enough for what I need.

Still hard to believe why it's so hard to convert number to string in Splunk, which is much easier in other places, like Excel, Powershell, etc.

Thanks

Allen

0 Karma
Get Updates on the Splunk Community!

What's New in Splunk Observability Cloud and Splunk AppDynamics - May 2025

This month, we’re delivering several new innovations in Splunk Observability Cloud and Splunk AppDynamics ...

Getting Started with Splunk Artificial Intelligence, Insights for Nonprofits, and ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Splunk Observability Cloud’s AI Assistant in Action Series: Identifying Unknown ...

Agentic AI powers the Splunk AI Assistant within the Splunk Observability Cloud interface to help you quickly ...