Splunk Search

addcoltotals

nithys
Communicator

Screenshot 2023-11-03 at 2.22.56 PM.png

 

I have used the below query to get the total from that column
Index="" source=""
| fields queryHits | table queryHits | addcoltotals labelfield=total label="queryHits"...
Now how do i get only the last row which is the total to display in my dashboard.I tried using stats count but its not fetching the correct vaue

 

 

 

Labels (1)
Tags (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

You could just take the last line using tail

index="" source=""
| fields queryHits 
| table queryHits 
| addcoltotals labelfield=total label="queryHits"
| tail 1

but there's a better way to get just the total

Index="" source=""
| stats sum(queryHits) as queryHits

 

---
If this reply helps you, Karma would be appreciated.

nithys
Communicator

thank you 

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Tech Talk Recap | Mastering Threat Hunting

Mastering Threat HuntingDive into the world of threat hunting, exploring the key differences between ...

Observability for AI Applications: Troubleshooting Latency

If you’re working with proprietary company data, you’re probably going to have a locally hosted LLM or many ...

Splunk AI Assistant for SPL vs. ChatGPT: Which One is Better?

In the age of AI, every tool promises to make our lives easier. From summarizing content to writing code, ...