Splunk - Displaying addcoltotals into its own column

Question

I have a report where I am working with event logs. I have created a table with fields that are extracted from the event logs.

This is my splunk query:

| stats count as Total_by_Requester values(*) as * by Requester_Id 
| table Type_of_Call LOB DateTime_Stamp Policy_Number Requester_Id Last_Name State City Zip Total_by_Requester 
| addcoltotals labelfield=Type_of_Call label="Grand Total" Total_by_Requester

Here I am taking the count of Requester_Id and then displaying it in Total_by_Requester field/column in the table and then doing the addcoltotals command to the get the total of Tota_by_Requester field

The issue that this query has is that it is displaying the Grand Total right underneath the Type_of_Call column, I want to display the Grand Total in its own column after the Total_by_Requester column

Picture of the issue

I have tried doing this query which brings the Grand Total to it's own column and has the right value but gets rid of all the other columns:

| stats count as Total_by_Requester values(*) as * by Requester_Id
| stats sum(Total_by_Requester) as Grand_Total
| table Type_of_Call LOB DateTime_Stamp Policy_Number Requester_Id Last_Name State City Zip Total_by_Requester Grand_Total

Issue in picture:

score 2 · Accepted Answer · answered Oct 18 '22 at 19:35

The labelfield option to addcoltotals tells the command where to put the added label. If the specified field name already exists then the label will go in that field, but if the value of the labelfield option is new then a new column will be created.

However, to create an entirely separate Grand_Total field, use the appendpipe command. The command applies a set of commands to the existing result set without triggering a new search.

| table Type_of_Call LOB DateTime_Stamp Policy_Number Requester_Id Last_Name State City Zip count
| appendpipe 
    [ stats sum(count) as Grand_Total ]

Splunk - Displaying addcoltotals into its own column

1 Answers1