Splunk Search

How to append column total to column name?

sandeepmakkena
Contributor

I have data something like this

Name. Accepted Rejected Posted Total

Change 3 5 7 15
NOC 5 6 5 16
8 11 12 21

Which I am getting by this command

Index=#####
| chart dc(TID) as count by Name Status
| addtotals 
| addcolTotals

What I wanted is
Name. Accepted(8) Rejected(11) Posted(12) Total(21)

Change 3 5 7 15
NOC 5 6 5 16
8 11 12 21
I did try | eval status=status."(".count.")"
Thanks for your time!

1 Solution

woodcock
Esteemed Legend

Here is a run-anywhere example that does it:

index=_* 
| rename component AS Status, sourcetype AS Name
| chart useother=f usenull=f limit=3 count BY Name Status 

| rename COMMENT AS "Everything above generates sample event data; everything below is your solution"

| addtotals row=t col=t
| eval Name=coalesce(Name, "Grand Totals")
| rename Name AS _Name
| eventstats max(*) AS total_*
| foreach total_* [ eval <<FIELD>> = "<<MATCHSTR>>(" . <<FIELD>> . ")", {<<FIELD>>} = <<MATCHSTR>> | fields - <<FIELD>> <<MATCHSTR>> ]
| rename _Name AS Name

View solution in original post

0 Karma

woodcock
Esteemed Legend

Here is a run-anywhere example that does it:

index=_* 
| rename component AS Status, sourcetype AS Name
| chart useother=f usenull=f limit=3 count BY Name Status 

| rename COMMENT AS "Everything above generates sample event data; everything below is your solution"

| addtotals row=t col=t
| eval Name=coalesce(Name, "Grand Totals")
| rename Name AS _Name
| eventstats max(*) AS total_*
| foreach total_* [ eval <<FIELD>> = "<<MATCHSTR>>(" . <<FIELD>> . ")", {<<FIELD>>} = <<MATCHSTR>> | fields - <<FIELD>> <<MATCHSTR>> ]
| rename _Name AS Name
0 Karma

sandeepmakkena
Contributor

This is wonderful @woodcock, Thanks for your help!

kamlesh_vaghela
SplunkTrust
SplunkTrust

@sandeepmakkena

Can you please try this?

 Index=#####
 | chart dc(TID) as count by Name Status
 | addtotals 
| table Name Accepted Rejected Posted Total | addcolTotals labelfield=Name label="my_total" | transpose header_field=Name | eval column=column."(".my_total.")" | transpose header_field=column  | rename column as Name

Sample Search:

| makeresults | eval _raw="Name Accepted Rejected Posted Total
Change 3 5 7 15
NOC 5 6 5 16" | multikv | table Name Accepted Rejected Posted Total | addcolTotals labelfield=Name label="my_total" | transpose header_field=Name | eval column=column."(".my_total.")" | transpose header_field=column  | rename column as Name

Note: You can remove | table Name Accepted Rejected Posted Total if the sequence of fields is the same.

0 Karma

sandeepmakkena
Contributor

@kamlesh_vaghela Thanks for responding but, it does not work.

I am getting something like this.

Name row 1 row 2 row 3
AE 2 0 2
AT 5 0 6
AU 2 0 3
BE 6 0 6
BR 24 0 31

I already tried something similar, I think I am missing something, Thanks!

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...