Documentation > Splunk > Search Reference > addtotals

Search Reference

 


Introduction
Search Overview
Search Commands and Functions
Search Command Reference
Custom Search Commands
Search in the CLI

addtotals

Contents

addtotals

Synopsis

Computes the sum of all numeric fields for each result.

Syntax

addtotals [row=bool] [col=bool] [labelfield=field] [label=string] [fieldname=field] field-list

Required arguments

field-list
Syntax: <field>...
Description: One or more numeric fields, delimited with a space, and can not include wildcards.

Optional arguments

row
Datatype: <bool>
Description: Specifies whether to compute the arithmetic sum of field-list for each result. Defaults to true.
col
Datatype: <bool>
Description: Specifies whether to add a new result (a summary event) that represents the sum of each field. Defaults to false.
fieldname
Datatype: <field>
Description: If row=true, use this to specify the name of the field to put the sum.
label
Datatype: <string>
Description: If labelfield is specified, it will be added to this summary event with the value set by the 'label' option.
labelfield
Datatype: <field>
Description: If col=true, use this to specify a name for the summary event.

Description

The default addtotals command (row=true) computes the arithmetic sum of all numeric fields that match field-list (wildcarded field list). If list is empty all fields are considered. The sum is placed in the specified field or total if none was specified.

If col=t, addtotals computes the column totals, which adds a new result at the end that represents the sum of each field. labelfield, if specified, is a field that will be added to this summary event with the value set by the 'label' option. Alternately, instead of using | addtotals col=true, you can use the addcoltotals command to calculate a summary event.

Examples

Example 1: Compute the sums of the numeric fields of each results.

... | addtotals

Example 2: Calculate the sums of the numeric fields of each result, and put the sums in the field "sum".

... | addtotals fieldname=sum

Example 3: Compute the sums of the numeric fields that match the given list, and save the sums in the field "sum".

... | addtotals fieldname=sum foobar* *baz*

Example 4: Compute the sums of all the fields, and put the sums in a summary event called "change_name".

... | addtotals col=t labelfield=change_name label=ALL


See also

stats

Answers

Have questions? Visit Splunk Answers and see what questions and answers the Splunk community has using the addtotals command.

Retrieved from "http://docs.splunk.com/Documentation/Splunk/4.3/SearchReference/Addtotals"

This documentation applies to the following versions of Splunk: 4.1 , 4.1.1 , 4.1.2 , 4.1.3 , 4.1.4 , 4.1.5 , 4.1.6 , 4.1.7 , 4.1.8 , 4.2 , 4.2.1 , 4.2.2 , 4.2.3 , 4.2.4 , 4.2.5 , 4.3 View the Article History for its revisions.


You must be logged into splunk.com in order to post comments. Log in now.

Was this documentation topic helpful?

If you'd like to hear back from us, please provide your email address:

We'd love to hear what you think about this topic or the documentation as a whole. Feedback you enter here will be delivered to the documentation team.