Splunk Search

problem with addcoltotals

abhayneilam
Contributor

Hi,

I have a file like :

XXXX 20
YYYY 40
ZZZZ 60

I am running a query ....|addcoltotals

I am getting :
XXXX 20
YYYY 40
ZZZZ 60
120

but I also want to mention Grand_Total in the first field as I want my output like :

XXXX 20
YYYY 40
ZZZZ 60
Total 120

"Total" String should come...

Please help !!

Thanks in Advance

0 Karma
1 Solution

jonuwz
Influencer

An example :

 * | stats count by sourcetype | addcoltotals labelfield=sourcetype label="Total"

labelfield is the column you want the label to appear in

label is the text in the labelfield.

View solution in original post

tmnteam
Engager

Hello,

I have a search with a "stats [...] by _time" at the end. (with a bin span=hour)

I have tried with labelfield=_time but it doesn't work (value is 0NaN-NaN-NaN NaN:NaN:NaN)

Is it possible to remap this label?

Thank you in advance.

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Since _time is in the epoch format (after your query) and with addtotal, you're trying to add a row with _time="Total" (not a valid date format).

0 Karma

jonuwz
Influencer

An example :

 * | stats count by sourcetype | addcoltotals labelfield=sourcetype label="Total"

labelfield is the column you want the label to appear in

label is the text in the labelfield.

Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...