Splunk Search

How to add new row in table on runtime

geetanjali
Path Finder

Hi,

i have data :

    host       max(Power_consumption)
1   ABC         150
2   XYZ         135

I want to add 150+135=285 and display it in next row and total.

    host        max(Power_consumption)
1   ABC         150
2   XYZ         135
    Total        285
Tags (1)
0 Karma

MarioM
Motivator

Did you try "| addtotals fieldname=Total max(Power_consumption)"?

MarioM
Motivator

if your field to do total is max(Power_consumption) just add it after it,and you can use several fields and wildcard too.
I modified my initial answer

0 Karma

geetanjali
Path Finder

addtotal will add all Power_consumption values from entire log. I need to add only maximum power consumption values

0 Karma
Get Updates on the Splunk Community!

Building Reliable Asset and Identity Frameworks in Splunk ES

 Accurate asset and identity resolution is the backbone of security operations. Without it, alerts are ...

Cloud Monitoring Console - Unlocking Greater Visibility in SVC Usage Reporting

For Splunk Cloud customers, understanding and optimizing Splunk Virtual Compute (SVC) usage and resource ...

Automatic Discovery Part 3: Practical Use Cases

If you’ve enabled Automatic Discovery in your install of the Splunk Distribution of the OpenTelemetry ...