Splunk Search

How do you calculate the totals of each table row and display those values as new fields?

johnward4
Communicator

How do you calculate the totals of each single row of a table and display that value in a new fields, much like addcoltotals but for rows?

0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Use eval.

index=foo | eval total=field1 + field2 + field3 | table field1, field2, field3, total

You can also use foreach if you don't want to add the fields yourself.

index=foo | fields - _time | eval total=0 | foreach * [eval total=total+<<FIELD>>] | table *
---
If this reply helps you, Karma would be appreciated.

View solution in original post

jotne
Builder

You can use the command addtotals totals for rows.

 

| makeresults
| eval mon=10, tue=23, wen=12, thu=2, fri=15
| addtotals

You get a new field with name Total with value 62

 

0 Karma

vikas_baranwal
Path Finder

Hi John,

I hope you must have got the answer but just for addition,

You can also use addtotals in the last of your SPL so it will add a new column named "Total" as last of the columns. and for each row as a result, it will be sum of numeric values of every column in the table.

Thanks

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Use eval.

index=foo | eval total=field1 + field2 + field3 | table field1, field2, field3, total

You can also use foreach if you don't want to add the fields yourself.

index=foo | fields - _time | eval total=0 | foreach * [eval total=total+<<FIELD>>] | table *
---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...