Usage of Splunk commands : ADDCOLTOTALS is as follows :
Computes and appends a new result with fields that represent the sum of
all values of numeric fields in the input
Find below the skeleton of the usage of the command “addcoltotals” in SPLUNK :
addcoltotals [labelfield=] [ label=] []
index=_internal | head 3 | table date_year,date_second | addcoltotals
date_year | date_second |
---|---|
2015 | 49 |
2015 | 49 |
2015 | 48 |
6045 | 146 |
index=_internal
| head 3
| table date_year,date_second
| addcoltotals date_second
Result :
date_year | date_second |
---|---|
2015 | 49 |
2015 | 49 |
2015 | 48 |
146 |
Explanation :
Now,we have specified the specific <fieldname>
on which “addcoltotals” should show its magic.
146 is the totals of “date_second” column and
there is no total count for “date_year” column.
*************************************************
Example -3 :
index=_internal | head 3 | table date_year,date_second | addcoltotals date_second labelfield="NEW_FIELD"
Result :
date_year | date_second | NEW_FIELD |
---|---|---|
2015 | 51 | |
2015 | 51 | |
2015 | 51 | |
153 | Total |
Explanation :
In this case we have used “labelfield” option.
It will add a new column called “NEW_FIELD” and
it will show the “Total” String by default
at the bottom where you have the total value
calculated for the “date_second” field.
Note : If instead of by default value “Total” , we want to
our own string “SUM” , then you have to do the following:
…|addcoltotals date_second labelfield=”NEW_FIELD” label=”SUM”
*************************************************
Example -4 :
index=_internal
| head 3
| table date_year,date_second
| addcoltotals date_second labelfield="date_year" label="SUM"
Result :
date_year | date_second |
---|---|
2015 | 58 |
2015 | 58 |
2015 | 58 |
SUM | 174 |
Explanation :
In this case we have put the “SUM” String in
the existing column “date_year” to make the
report look beautiful and professional
Note : ‘label‘ has no effect if ‘labelfield‘ is not defined
interesting information. This is just the kind of information that i had been looking for, i'm already your rss reader now and i would regularly watch out for the new posts,Thanks a million once again, Regards
[…] , drilldown panel should not open as Total is not a value of method field. It has come for using addcoltotals command. So how to do that thing […]