Splunk Search

AddColTotals

xvxt006
Contributor

Hi, I want to get the count of errors. So i have a query to get the count by status where status is greater than 400. When i use addcoltotals, it is thinking status as a column and hence it is giving the total for both. How can i get that?

/Current
No status count
1 200 26
2 302 57
3 502 83

Expected

No status count
1 200 26
2 302 57
3 Total 83

sourcetype=access_combined_wcookie host="qqqq*" uri=/checklogin* status>400 | stats count by status | addcoltotals label=Total labelfield=status

Tags (1)
0 Karma
1 Solution

bmunson_splunk
Splunk Employee
Splunk Employee

You should be able to just name the fields you want totals for.

sourcetype=access_combined_wcookie host="qqqq" uri=/checklogin status>400 | stats count by status | addcoltotals count label=Total labelfield=status

View solution in original post

xvxt006
Contributor

Thank you !!! This worked fine.

0 Karma

bmunson_splunk
Splunk Employee
Splunk Employee

You should be able to just name the fields you want totals for.

sourcetype=access_combined_wcookie host="qqqq" uri=/checklogin status>400 | stats count by status | addcoltotals count label=Total labelfield=status

aholzer
Motivator

I don't think it's possible to exclude with addColTotals, but you should be able to with addTotals. Here's the documentation: http://docs.splunk.com/Documentation/Splunk/5.0.3/SearchReference/Addtotals

Your search would look like this:
sourcetype=access_combined_wcookie host="qqqq" uri=/checklogin status>400 | stats count by status | addTotals col=t label=Total labelfield=status count

0 Karma
Get Updates on the Splunk Community!

Welcome to the Future of Data Search & Exploration

You have more data coming at you than ever before. Over the next five years, the total amount of digital data ...

What’s new on Splunk Lantern in August

This month’s Splunk Lantern update gives you the low-down on all of the articles we’ve published over the past ...

This Week's Community Digest - Splunk Community Happenings [8.3.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...