Here is my current query. I either get the Totals label in the last column or not at all. I need it to show in the first column at the beginning of the Totals row. Any help is greatly appreciated. Thanks.
index=etims_na
sourcetype=etims_prod
platformId=5
bank_fiid=CHUA
| eval response_time=round(if(strftime(_time,"%Z") == "EDT",((j_timestamp-entry_timestamp)-14400000000)/1000000,((j_timestamp-entry_timestamp)-14400000000)/1000000-3600),3)
| stats count AS Transactions count(eval(response_time <= 1)) AS "Good" count(eval(response_time <= 2)) AS "Fair" count(eval(response_time > 2)) AS "Unacceptable" avg(response_time) AS "Average" BY bank_fiid
| eval "%Good"=(Good/Transactions)*100
| eval "%Fair"=(Fair/Transactions)*100
| eval "%Unacceptable"=(Unacceptable/Transactions)*100
| addinfo
| eval "Report Date"=strftime(info_min_time, "%m/%Y")
| table bank_fiid, "Transactions", "Good", "%Good" "Fair", "%Fair", "Unacceptable", "%Unacceptable", "Average", "Report Date"
| rename bank_fiid as "Vision ID"
| addcoltotals label=Total
| append [|makeresults
| eval "Vision ID"="Threshold"
| eval "Good" = "response <= 1s"
| eval "Fair" = "1s < response <= 3s"
| eval "Unacceptable" = "3s < response"]
| fields - _time
Use the labelfield option. It tells Splunk into which field (column) to put the total.
...
| table bank_fiid, "Transactions", "Good", "%Good" "Fair", "%Fair", "Unacceptable", "%Unacceptable", "Average", "Report Date"
| rename bank_fiid as "Vision ID"
| addcoltotals label=Total labelfield=bank_fiid
...
Never mind. I posted too soon. I replaced "| addcoltotals label=Total " with "| addcoltotals labelfield="Vision ID" label="Total"" and it worked. Thanks.
Use the labelfield option. It tells Splunk into which field (column) to put the total.
...
| table bank_fiid, "Transactions", "Good", "%Good" "Fair", "%Fair", "Unacceptable", "%Unacceptable", "Average", "Report Date"
| rename bank_fiid as "Vision ID"
| addcoltotals label=Total labelfield=bank_fiid
...
Thanks! This was exactly the fix I found.