How to add a separate column which displays the total of the count?

[pavanae]

The following is my search

…..My Search…… | stats count by orderid,source,host

Which displays the following results

orderid source host count
971729145 /jboss/server/12commerce/log/server.log kvcldprdapp02a 1
106283305 /jboss/server/20cap/log/server.log kvcldprdapp01b 1
147093787 /jboss/server/13commerce/log/server.log kvcldprdapp08b 1
569279529 /jboss/server/11commerce/log/server.log kvcldprdapp01a 2
670563206 /jboss/server/13commerce/log/server.log kvcldprdapp03b 1
862422991 /jboss/server/12commerce/log/server.log kvcldprdapp07b 1
038357748 /jboss/server/12commerce/log/server.log kvcldprdapp03b 1

Now how can i modify my search to display a separate column and shows the total count as follows

orderid source host count Total_Count
971729145 /jboss/server/12commerce/log/server.log kvcldprdapp02a 1 8
106283305 /jboss/server/20cap/log/server.log kvcldprdapp01b 1
147093787 /jboss/server/13commerce/log/server.log kvcldprdapp08b 1
569279529 /jboss/server/11commerce/log/server.log kvcldprdapp01a 2
670563206 /jboss/server/13commerce/log/server.log kvcldprdapp03b 1
862422991 /jboss/server/12commerce/log/server.log kvcldprdapp07b 1
038357748 /jboss/server/12commerce/log/server.log kvcldprdapp03b 1

[rroberts]

Have you tried adding ... | appendpipe [stats sum(count) as Total_Count]

[somesoni2]

Appendpipe will add a row with total, not the Total as separate column

[rroberts]

Yes, but you'll get the total repeated on each row with eventstats. I think he only wants the grand total displayed once?

[somesoni2]

Well I may be wrong with interpretation of his requirement. And when I look at the expected output, yes that's misleading.
Guess it upto @pravanae, to decide which format he wanted.

[rroberts]

Indeed. I could be wrong too!

[somesoni2 · Accepted solution]

Try this

…..My Search…… | stats count by orderid,source,host | eventstats sum(count) as Total_Count