Extracting the values from addtotals/addcoltotals from timechart.

[ronaldtanhj]

Hi All,

I would like to extract the values from addtotals.

My current result from my search is as follows;

_time	fielda	fieldb	fieldc	fieldd	Total by Day
day_1	1	2	1	2	6
day_2	2	2	2	2	8
day_....	1	1	1	1	4
day_n	3	1	2	4	11
Total by field	7	6	6	9

The last lines of my search is as follows:

|....
|timechart span=1d sum(A) as B by C limit=0
|addtotals col=t labelfield=_time label="Total by Field" fieldname="Total by Day"

After the 'addtotals' portion, I would like to extract out the values of "Total by Field" (shown in bold and underlined) for further calculations. Or if there is an alternative method to use instead of 'addtotals'

I've tried stats sum and eval to do so but couldn't do it.

Anyone here able to advise on this?

Thanks and advance!

[kennetkline]

If you want to see sum totals then just truncate _time (by day) drop the time:

Then do sum using stats by day;  something like this;  I put total_by_day as total record count in case you want to care it down to see; but was not a field you wanted, figured would show that.

search ...
| eval day=strftime(_time, "%Y-%m-%d")
| stats sum(fielda) as total_a, sum(fieldb) as total_b, sum(fieldc) as total_c, sum(feildd) as total_d, count as total_by_day by day
| table day total_a, total_b, total_c, total_d
| rename day as "Total by Field"