Splunk Search

How to always display last (summary) row in table?

dehtallyutedeh
Explorer

I have a list of results in a table that spans on different pages.

*first page*

Col 1          Col2          Summary
apples         12
grapes         8
....

*last page*
cherries       20
               40             Summary

I used the addcoltotal function to get the "Summary" row.
The "summary" row only displays on the last page.
I'd like to now know if it's possible to always have the "Summary" row displayed as I navigate throughout the the pages in my table.

Thanks.

maciep
Champion

you could also add another column for the total instead of using addcoltotals.

... | eventstats sum(Col2) as Summary

It might also be possible to put the total in the panel title? Maybe?

0 Karma

DalJeanis
Legend

Yes, it's possible, but you need to do it a different way.

Your list of results needs to be the base search, and then you will have two panels. The first panel will display your details, basically the whole results of the base search, and the second panel will display your totals of the records in the base search.

0 Karma
Get Updates on the Splunk Community!

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...