select coalesce(class,"total") as class, coalesce(name,"total") as name, sum(num) as sum from table a group by grouping sets (class,name,(class,name)) In mysql I can get sum from each group and a total at the same time, from the left table to the right one.  can I do the same in Splunk? ... View more

Hi, I try to apply untable on a table like this |untable id class pick num I try to get a table like this ,but it doesn't work. Is there any way to solve this one? ... View more

that works thx!!!! ... View more