Splunk Search

How to Add Totals Line for Stats

David
Splunk Employee
Splunk Employee

I feel like this is something I should know already, but I can't find it anywhere.

If I have a query that calculates an amount of bandwidth, and a total cost per datacenter, say:

MySearch Host=MyHost | eval MBPS=.... 
                     | eval Cost=MBPS * 22 
                     | stats sum(Cost) as "Cost ($)" by datacenter

That will show the cost of running host MyHost for each datacenter. How do I have stats generate a totals line, that will show the total cost overall, without appending an identical search?

Tags (1)
1 Solution

sideview
SplunkTrust
SplunkTrust

Take a look at the addtotals command.

MySearch Host=MyHost | eval MBPS=.... 
| eval Cost=MBPS * 22 
| stats sum(Cost) as "Cost ($)" by datacenter
| addtotals

It will create a new row with the value of Host set to "Total", and the value of "Cost ($)" set to the appropriate total.

View solution in original post

sideview
SplunkTrust
SplunkTrust

Take a look at the addtotals command.

MySearch Host=MyHost | eval MBPS=.... 
| eval Cost=MBPS * 22 
| stats sum(Cost) as "Cost ($)" by datacenter
| addtotals

It will create a new row with the value of Host set to "Total", and the value of "Cost ($)" set to the appropriate total.

David
Splunk Employee
Splunk Employee

Ah ha! That sorted it (though in this case, it was addcoltotals instead of addtotals).

Thank you, sir!

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...