Splunk Search

How to always display last (summary) row in table?


I have a list of results in a table that spans on different pages.

*first page*

Col 1          Col2          Summary
apples         12
grapes         8

*last page*
cherries       20
               40             Summary

I used the addcoltotal function to get the "Summary" row.
The "summary" row only displays on the last page.
I'd like to now know if it's possible to always have the "Summary" row displayed as I navigate throughout the the pages in my table.



you could also add another column for the total instead of using addcoltotals.

... | eventstats sum(Col2) as Summary

It might also be possible to put the total in the panel title? Maybe?

0 Karma


Yes, it's possible, but you need to do it a different way.

Your list of results needs to be the base search, and then you will have two panels. The first panel will display your details, basically the whole results of the base search, and the second panel will display your totals of the records in the base search.

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!