Splunk Search

addcoltotals

nithys
Communicator

Screenshot 2023-11-03 at 2.22.56 PM.png

 

I have used the below query to get the total from that column
Index="" source=""
| fields queryHits | table queryHits | addcoltotals labelfield=total label="queryHits"...
Now how do i get only the last row which is the total to display in my dashboard.I tried using stats count but its not fetching the correct vaue

 

 

 

Labels (1)
Tags (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

You could just take the last line using tail

index="" source=""
| fields queryHits 
| table queryHits 
| addcoltotals labelfield=total label="queryHits"
| tail 1

but there's a better way to get just the total

Index="" source=""
| stats sum(queryHits) as queryHits

 

---
If this reply helps you, Karma would be appreciated.

nithys
Communicator

thank you 

0 Karma
Get Updates on the Splunk Community!

Preparing your Splunk Environment for OpenSSL3

The Splunk platform will transition to OpenSSL version 3 in a future release. Actions are required to prepare ...

Unleash Unified Security and Observability with Splunk Cloud Platform

     Now Available on Microsoft AzureThursday, March 27, 2025  |  11AM PST / 2PM EST | Register NowStep boldly ...

Splunk AppDynamics with Cisco Secure Application

Web applications unfortunately present a target rich environment for security vulnerabilities and attacks. ...