Splunk Search
Highlighted

How do you calculate the totals of each table row and display those values as new fields?

Communicator

How do you calculate the totals of each single row of a table and display that value in a new fields, much like addcoltotals but for rows?

0 Karma
Highlighted

Re: How do you calculate the totals of each table row and display those values as new fields?

SplunkTrust
SplunkTrust

Use eval.

index=foo | eval total=field1 + field2 + field3 | table field1, field2, field3, total

You can also use foreach if you don't want to add the fields yourself.

index=foo | fields - _time | eval total=0 | foreach * [eval total=total+<<FIELD>>] | table *
---
If this reply helps you, an upvote would be appreciated.

View solution in original post

Highlighted

Re: How do you calculate the totals of each table row and display those values as new fields?

Path Finder

Hi John,

I hope you must have got the answer but just for addition,

You can also use addtotals in the last of your SPL so it will add a new column named "Total" as last of the columns. and for each row as a result, it will be sum of numeric values of every column in the table.

Thanks

0 Karma