Splunk Search

How do you calculate the totals of each table row and display those values as new fields?

johnward4
Communicator

How do you calculate the totals of each single row of a table and display that value in a new fields, much like addcoltotals but for rows?

0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Use eval.

index=foo | eval total=field1 + field2 + field3 | table field1, field2, field3, total

You can also use foreach if you don't want to add the fields yourself.

index=foo | fields - _time | eval total=0 | foreach * [eval total=total+<<FIELD>>] | table *
---
If this reply helps you, an upvote would be appreciated.

View solution in original post

vikas_baranwal
Path Finder

Hi John,

I hope you must have got the answer but just for addition,

You can also use addtotals in the last of your SPL so it will add a new column named "Total" as last of the columns. and for each row as a result, it will be sum of numeric values of every column in the table.

Thanks

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Use eval.

index=foo | eval total=field1 + field2 + field3 | table field1, field2, field3, total

You can also use foreach if you don't want to add the fields yourself.

index=foo | fields - _time | eval total=0 | foreach * [eval total=total+<<FIELD>>] | table *
---
If this reply helps you, an upvote would be appreciated.
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...