Splunk Search

How do I use the addcoltotals command with a stats list or stats values?

johnward4
Communicator

How do I use addcoltotals with a stats list or with stats values?

I'm trying to include the totals for each line value after running a stats list or values on a field with a numeric value and pipe addcoltotals , but it is skipping any values that are represented in my list or values table visualization. Anyone know how to get this to work?

| stats values(Total) as Total, values(example) as example by thing
| table thing, example, Total
| addcoltotals labelfield=thing label="Grand Total:"
0 Karma
1 Solution

KailA
Contributor

Hi,

Can you try something like that

| eventstats sum(Total) as GrandTotal by things
| stats values(Total) as Total, values(example) as example values(GrandTotal) as GrandTotal by thing
| table thing, example, Total,GrandTotal

Doing the sum of the Total before should be a good solution.

KailA

View solution in original post

vinaykata
Path Finder

Your search is almost correct try using sum(Total) instead of values.

Your search | stats sum(Total) as Total by host | addcoltotals labelfield="fieldName" label="GrandTotal" | your table command

0 Karma

KailA
Contributor

Hi,

Can you try something like that

| eventstats sum(Total) as GrandTotal by things
| stats values(Total) as Total, values(example) as example values(GrandTotal) as GrandTotal by thing
| table thing, example, Total,GrandTotal

Doing the sum of the Total before should be a good solution.

KailA

johnward4
Communicator

alt text

0 Karma

Vijeta
Influencer

When you do list or value even on numeric values I believe the list command converts it into string and that is why you cannot add multivalued column. I would rather do it as

  stats sum(Total) by Example Thing
0 Karma

Vijeta
Influencer

Can you please give an example of data or output that you are expecting? Anyways addcoltotals will not work with list or value as they are non-numeric

0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...