Hello
"Good Day"
I am trying to add the extra column for totals. If you observe above picture, I have four counts of domain and now i need one more column which gives sum of all the above columns and it should be seen in dashboard
I need to get output of field domain in this form
Can you please help me to find the solutions.
Hi @renuka,
You have to create a Post Process Search containing your full search (without addcoltotals).
e.g.:
...
| stats count BY CRS_Domain
and in each panel call the base search adding an additional search filtering in each panel put a final filter, e.g. if your base search is called "basesearch", in the "V&V" panel you'll have:
<search base="basesearch">
<query>
| search CRS_Domain="V&V"
| table count
</query>
</search>
instead in the last panle (total), you have to add:
<search base="basesearch">
<query>
| addcoltotals labelfield=CRS_Domain label="Total"
| search sourcetype=Total
| table count
</query>
</search>
If you want to better understand how Post process Search works see at https://docs.splunk.com/Documentation/Splunk/8.2.0/Viz/Savedsearches#Post-process_searches_2 or see the Splunk Dashboard Examples App (https://splunkbase.splunk.com/app/1603/).
Ciao.
Giuseppe
Hi @renuka,
the searches of the panels, are similar or all different?
because it isn't possible to pass a token from a panel to another without drilldown,
so in the total panel you have to use a search that gives all the values to sum.
So if they are similar, you could create a post process search and put in each panel the value.
Ciao.
Giuseppe
@gcusello
They are similar
I tried adding addcoltotals which actually giving me the sum of all the above but in visualizaton i couldn't display all four value count and total
Hi @renuka,
You have to create a Post Process Search containing your full search (without addcoltotals).
e.g.:
...
| stats count BY CRS_Domain
and in each panel call the base search adding an additional search filtering in each panel put a final filter, e.g. if your base search is called "basesearch", in the "V&V" panel you'll have:
<search base="basesearch">
<query>
| search CRS_Domain="V&V"
| table count
</query>
</search>
instead in the last panle (total), you have to add:
<search base="basesearch">
<query>
| addcoltotals labelfield=CRS_Domain label="Total"
| search sourcetype=Total
| table count
</query>
</search>
If you want to better understand how Post process Search works see at https://docs.splunk.com/Documentation/Splunk/8.2.0/Viz/Savedsearches#Post-process_searches_2 or see the Splunk Dashboard Examples App (https://splunkbase.splunk.com/app/1603/).
Ciao.
Giuseppe
Thank you for helping
Hi @renuka,
good for you, see next time!
Ciao and happy splunking.
Giuseppe
P.S.: Karma Points are appreciated 😉