I have the following search. index=main_index sourcetype="hec:google" operationName=createMobileAuthenticationOutcome direction=response source="customers-mobile-authentications-v1" | dedup correlationId | stats count by eventData.log{}.downstreamRequestAdditionalLog.request.applicationEntryType eventData.log{}.downstreamRequestAdditionalLog.request.authenticationOutcome | sort -count | eventstats sum(count) as tot by eventData.log{}.downstreamRequestAdditionalLog.request.applicationEntryType | eval perc = round(count/tot*100,1) | stats list(eventData.log{}.downstreamRequestAdditionalLog.request.authenticationOutcome) as "OutCome Request Details" list(count) as Count, list(perc) as "% per Auth Type" by eventData.log{}.downstreamRequestAdditionalLog.request.applicationEntryType | appendpipe [ stats sum(Count) as Count, sum("% per Auth Type") as "% per Auth Type" by eventData.log{}.downstreamRequestAdditionalLog.request.applicationEntryType | eval "OutCome Request Details" = "Total Request"] | sort eventData.log{}.downstreamRequestAdditionalLog.request.applicationEntryType | rename eventData.log{}.downstreamRequestAdditionalLog.request.applicationEntryType as "Auth Type" which shows this table. But.... What I want to do is add another row for the total number of directOpenApp.Completed and pushNotifications.Completed I've tried addtotals and can't get my head around appendcols. Thanks r
... View more