Related Answers
Download topic as PDF
addcoltotals
Description
The addcoltotals command appends a new result to the end of the search result set. The result contains the sum of each numeric field or you can specify which fields to summarize. Results are displayed on the Statistics tab. If the labelfield argument is specified, a column is added to the statistical results table with the name specified.
Syntax
addcoltotals [labelfield=<field>] [label=<string>] [<fieldlist>]
Optional arguments
- <fieldlist>
- Syntax: <field> ...
- Description: A space delimited list of valid field names. The
addcoltotalscommand calculates the sum only for the fields in the list you specify. You can use the asterisk ( * ) as a wildcard in the field names. - Default: Calculates the sum for all of the fields.
- labelfield
- Syntax: labelfield=<fieldname>
- Description: Specify a field name to add to the result set.
- Default: none
- label
- Syntax: label=<string>
- Description: Used with the
labelfieldargument to add a label in the summary event. If thelabelfieldargument is absent, thelabelargument has no effect. - Default: Total
Examples
Example 1:
Compute the sums of all the fields, and put the sums in a summary event called "change_name".
... | addcoltotals labelfield=change_name label=ALL
Example 2:
Add a column total for two specific fields in a table.
sourcetype=access_* | table userId bytes avgTime duration | addcoltotals bytes duration
Example 3:
Filter fields for two name-patterns, and get totals for one of them.
... | fields user*, *size | addcoltotals *size
Example 4:
Augment a chart with a total of the values present.
index=_internal source="metrics.log" group=pipeline |stats avg(cpu_seconds) by processor |addcoltotals labelfield=processor
See also
Answers
Have questions? Visit Splunk Answers and see what questions and answers the Splunk community has using the addcoltotals command.
|
PREVIOUS accum |
NEXT addinfo |
This documentation applies to the following versions of Splunk Cloud™: 6.6.3, 7.0.0, 7.0.2, 7.0.3, 7.0.5, 7.0.8, 7.0.11, 7.1.3, 7.1.6, 7.2.3, 7.2.4, 7.2.6, 7.2.7, 7.2.8, 7.2.9, 8.0.0
Comments
During the interactive aggregation phase of charting, the presumed left-hand label column may float rightward in the table (presumably due to the fact that a simple alphanumeric string sort puts other columnt headints before the label column). On completion of the search the label column snaps back to its correct position.
Is there a way to highlight (bold) the addcoltotals results.