Splunk Search

How do I use the addcoltotals command with a stats list or stats values?

Communicator

How do I use addcoltotals with a stats list or with stats values?

I'm trying to include the totals for each line value after running a stats list or values on a field with a numeric value and pipe addcoltotals , but it is skipping any values that are represented in my list or values table visualization. Anyone know how to get this to work?

| stats values(Total) as Total, values(example) as example by thing
| table thing, example, Total
| addcoltotals labelfield=thing label="Grand Total:"
0 Karma
1 Solution

Contributor

Hi,

Can you try something like that

| eventstats sum(Total) as GrandTotal by things
| stats values(Total) as Total, values(example) as example values(GrandTotal) as GrandTotal by thing
| table thing, example, Total,GrandTotal

Doing the sum of the Total before should be a good solution.

KailA

View solution in original post

Path Finder

Your search is almost correct try using sum(Total) instead of values.

Your search | stats sum(Total) as Total by host | addcoltotals labelfield="fieldName" label="GrandTotal" | your table command

0 Karma

Contributor

Hi,

Can you try something like that

| eventstats sum(Total) as GrandTotal by things
| stats values(Total) as Total, values(example) as example values(GrandTotal) as GrandTotal by thing
| table thing, example, Total,GrandTotal

Doing the sum of the Total before should be a good solution.

KailA

View solution in original post

Communicator

alt text

0 Karma

Influencer

When you do list or value even on numeric values I believe the list command converts it into string and that is why you cannot add multivalued column. I would rather do it as

  stats sum(Total) by Example Thing
0 Karma

Influencer

Can you please give an example of data or output that you are expecting? Anyways addcoltotals will not work with list or value as they are non-numeric

0 Karma