Splunk Search

How do I use the addcoltotals command with a stats list or stats values?

johnward4
Communicator

How do I use addcoltotals with a stats list or with stats values?

I'm trying to include the totals for each line value after running a stats list or values on a field with a numeric value and pipe addcoltotals , but it is skipping any values that are represented in my list or values table visualization. Anyone know how to get this to work?

| stats values(Total) as Total, values(example) as example by thing
| table thing, example, Total
| addcoltotals labelfield=thing label="Grand Total:"
0 Karma
1 Solution

KailA
Contributor

Hi,

Can you try something like that

| eventstats sum(Total) as GrandTotal by things
| stats values(Total) as Total, values(example) as example values(GrandTotal) as GrandTotal by thing
| table thing, example, Total,GrandTotal

Doing the sum of the Total before should be a good solution.

KailA

View solution in original post

vinaykata
Path Finder

Your search is almost correct try using sum(Total) instead of values.

Your search | stats sum(Total) as Total by host | addcoltotals labelfield="fieldName" label="GrandTotal" | your table command

0 Karma

KailA
Contributor

Hi,

Can you try something like that

| eventstats sum(Total) as GrandTotal by things
| stats values(Total) as Total, values(example) as example values(GrandTotal) as GrandTotal by thing
| table thing, example, Total,GrandTotal

Doing the sum of the Total before should be a good solution.

KailA

johnward4
Communicator

alt text

0 Karma

Vijeta
Influencer

When you do list or value even on numeric values I believe the list command converts it into string and that is why you cannot add multivalued column. I would rather do it as

  stats sum(Total) by Example Thing
0 Karma

Vijeta
Influencer

Can you please give an example of data or output that you are expecting? Anyways addcoltotals will not work with list or value as they are non-numeric

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Can’t Make It to Boston? Stream .conf25 and Learn with Haya Husain

Boston may be buzzing this September with Splunk University and .conf25, but you don’t have to pack a bag to ...

Splunk Lantern’s Guide to The Most Popular .conf25 Sessions

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Unlock What’s Next: The Splunk Cloud Platform at .conf25

In just a few days, Boston will be buzzing as the Splunk team and thousands of community members come together ...