Splunk Search
Highlighted

Is there a way to get addcoltotals to show up at the top of a report, rather than at the end?

Engager

I have a report that reports the count of events per another field. I can get a total of all of these events but it shows up at the bottom.
Can I get that total from "addcoltotals" to show up at the very top instead?

Highlighted

Re: Is there a way to get addcoltotals to show up at the top of a report, rather than at the end?

Legend

You could put a | sort fieldA fieldB etc at the end of your SPL. You will just need to figure out which fields to use for the sort to make the order come out the way you want...

0 Karma
Highlighted

Re: Is there a way to get addcoltotals to show up at the top of a report, rather than at the end?

Communicator

use sort option

0 Karma
Highlighted

Re: Is there a way to get addcoltotals to show up at the top of a report, rather than at the end?

Legend

@jbezanson...If addcoltotals is showing results in the end just add the following in the end | reverse. PS: If you are not sowing more than 10000 results then you can use sort as well. However, I would expect reverse to perform better.




| eval message="Happy Splunking!!!"


0 Karma
Highlighted

Re: Is there a way to get addcoltotals to show up at the top of a report, rather than at the end?

Explorer

One way to do this is to click the column name and it will bring it to the top, it will also sort the chart by highest to lowest. e.g. you couldn't have the column total at the top and have the lowest value below it.

alt text

0 Karma
Highlighted

Re: Is there a way to get addcoltotals to show up at the top of a report, rather than at the end?

SplunkTrust
SplunkTrust

Add the |sort - count after the |addcoltotals. It will sort your count by greatest to least.

{your search}
| addcoltotals
| sort - count
0 Karma