hi, i use stats for a lot of reports, generally using a "by" clause. Is there a way to generate a summary line for stats? For my specific use case, I want to do a sum of a column:
... | stats sum(something) as TotalSomething by category
That will give:
category TotalSomething
x 100
y 200
How do I add:
Total 300
To the report?
... | addcoltotals label=Total labelfield=category
could that be what you're looking for?
http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Addcoltotals
/K
... | addcoltotals label=Total labelfield=category
could that be what you're looking for?
http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Addcoltotals
/K
perfect. thank you. So many functions. So little time.
addcoltotal giving me total with out total label . How can i add label to display like total = 10,20,30