Usage of Splunk commands : ADDCOLTOTALS

  Usage of Splunk commands : ADDCOLTOTALS is as follows :

 Computes and appends a new result with fields that represent the sum of

  all values of numeric fields in the input 

 Find below the skeleton of the usage of the command “addcoltotals” in SPLUNK : 

addcoltotals [labelfield=] [ label=]  []

index=_internal
| head 3
| table date_year,date_second
| addcoltotals

index=_internal
| head 3
| table date_year,date_second
| addcoltotals date_second

Result :

Explanation :

            Now,we have specified the specific <fieldname>
            on which “addcoltotals” should show its magic.
            146 is the totals of “date_second” column and
            there is no total count for “date_year” column.



     *************************************************


Example -3 :

index=_internal
| head 3
| table date_year,date_second
| addcoltotals date_second labelfield="NEW_FIELD"

Result :

Explanation :

            In this case we have used “labelfield” option.
            It will add a new column called “NEW_FIELD” and
            it will show the “Total” String by default
            at the bottom where you have the total value 
            calculated for the “date_second” field.


Note : If instead of by default value “Total” , we want to
our own string “SUM” , then you have to do the following:


…|addcoltotals date_second labelfield=”NEW_FIELD” label=”SUM”

*************************************************

Example -4 :

index=_internal
| head 3
| table date_year,date_second
| addcoltotals date_second labelfield="date_year" label="SUM"      

Result :

Explanation :

            In this case we have put the “SUM” String in
            the existing column “date_year” to make the
            report look beautiful and professional


Note : ‘label‘ has no effect if ‘labelfield‘ is not defined