Splunk Search

How to specify which columns are totaled up?

jaj
Path Finder

What columns can I somehow override and specify which ones are totaled up? I only want the count to be totaled but other error codes are getting totaled as well.

alt text

Tags (2)
0 Karma
1 Solution

niketn
Legend

@jaj refer to addtotals or addcoltotals command which you can apply only for specific column

Forexample:

 | addtotals row=f col=t labelfield="Error Message" Count
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

0 Karma

niketn
Legend

@jaj refer to addtotals or addcoltotals command which you can apply only for specific column

Forexample:

 | addtotals row=f col=t labelfield="Error Message" Count
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

jaj
Path Finder

@niketnilay thank you again!

0 Karma
Get Updates on the Splunk Community!

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  🚀 Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Stronger Security with Federated Search for S3, GCP SQL & Australian Threat ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Accelerating Observability as Code with the Splunk AI Assistant

We’ve seen in previous posts what Observability as Code (OaC) is and how it’s now essential for managing ...