Hi Splunkers,
I am facing weird issue with addcoltotals command. While it is working perfectly fine if i open a new search tab but once i add the same query in Dashboard it is breaking down. I am trying to run the command in SplunkDB connect. Below is the snippet for reference. Below is the query
index=db_connect_dev_data
|rename PROCESS_DT as Date
| table OFFICE,Date,MOP,Total_Volume,Total_Value
| search OFFICE=GB1
|eval _time=strptime(Date,"%Y-%m-%d")
|addinfo
|eval info_min_time=info_min_time-3600,info_max_time=info_max_time-3600
|where _time>=info_min_time AND _time<=info_max_time
|table Date,MOP,OFFICE,Total_Volume,Total_Value
| addcoltotals "Total_Volume" "Total_Value" label=Total_GB1 labelfield=MOP
|filldown
| eval Total_Value_USD=Total_Value/1000000
| eval Total_Value_USD=round(Total_Value_USD,5)
| stats sum(Total_Volume) as "Total_Volume",sum("Total_Value_USD") as Total_Value(mn) by MOP
|search MOP=*
|table MOP,Total_Volume,Total_Value(mn)
Let me know if anyone know why it is happening,
... View more