addtotals
This documentation does not apply to the most recent version of Splunk. Click here for the latest version.
addtotals
Synopsis
Computes the sum of all numeric fields for each result.
Syntax
addtotals | addcoltotals [row=bool] [col=bool] [labelfield=field] [label=string] [fieldname=field] field-list
Arguments
- row
- Datatype: <bool>
- Description: Specifies whether to compute the arithmetic sum of field-list for each result. Defaults to true, if
addtotalsis invoked.
- col
- Datatype: <bool>
- Description: Specifies whether to add a new result (a summary event) that represents the sum of each field. Defaults to true, if
addcoltotalsis invoked.
- fieldname
- Datatype: <field>
- Description: Specify the name of the field to put the sum.
- label
- Datatype: <string>
- Description: If
labelfieldis specified, it will be added to this summary event with the value set by the 'label' option.
- labelfield
- Datatype: <field>
- Description: Specify a name for the summary event.
Description
If row=t (default if invoked as 'addtotals') for each result, computes the arithmetic sum of all numeric fields that match field-list (wildcarded field list). If list is empty all fields are considered. The sum is placed in the specified field or total if none was specified. If col=t (default if invoked as 'addcoltotals'), adds a new result at the end that represents the sum of each field. labelfield, if specified, is a field that will be added to this summary event with the value set by the 'label' option.
Examples
Example 1: Calculate the sums of the numeric fields of each result, and put the sums in the field "sum".
... | addtotals fieldname=sumExample 2: Compute the sums of all the fields, and put the sums in a summary event called "change_name".
... | addcoltotals labelfield=change_name label=ALLExample 3: Compute the sums of the numeric fields that match the given list, and save the sums in the field "sum".
... | addtotals fieldname=sum foobar* *baz*Example 4: Compute the sums of all the fields, and put the sums in a summary event called "change_name".
... | addtotals col=t labelfield=change_name label=ALLExample 5: Compute the sums of the numeric fields of each results.
... | addtotals
See also
This documentation applies to the following versions of Splunk: 4.0 , 4.0.1 , 4.0.2 , 4.0.3 , 4.0.4 , 4.0.5 , 4.0.6 , 4.0.7 , 4.0.8 , 4.0.9 , 4.0.10 , 4.0.11 View the Article History for its revisions.