Followers

Tuesday, May 5

Usage of Splunk commands : ADDCOLTOTALS



        Usage of Splunk commands : ADDCOLTOTALS is as follows :




      Computes and appends a new result with fields that represent the       sum of all values of numeric fields in the input 




         Find below the skeleton of the usage of the command "addcoltotals" in SPLUNK : 



               addcoltotals [labelfield=<field>] [ label=<String>]  [<fieldlist>]



Example -1 :


index=_internal 
| head 3 
| table date_year,date_second 
| addcoltotals



Result :

date_yeardate_second
201549
201549
201548
6045146


Explanation :

            6045 is the addition of the column "date_year" and
            146 is the addition of the column "date_second".

            We have not specified any <fieldname> after
            "addcoltotals", that's why it is summing up all
            fields value and showing in the result set.


*************************************************


Example -2 :



index=_internal 
| head 3 
| table date_year,date_second 
| addcoltotals date_second
       


Result :


date_yeardate_second
201549
201549
201548

146


Explanation :

            Now,we have specified the specific <fieldname>
            on which "addcoltotals" should show its magic.
            146 is the totals of "date_second" column and
            there is no total count for "date_year" column.



*************************************************


Example -3 :



index=_internal 
| head 3 
| table date_year,date_second 
| addcoltotals date_second labelfield="NEW_FIELD"
       


Result :



date_yeardate_secondNEW_FIELD
201551
201551
201551
153Total


Explanation :

            In this case we have used "labelfield" option.
            It will add a new column called "NEW_FIELD" and
            it will show the "Total" String by default
            at the bottom where you have the total value 
            calculated for the "date_second" field.


Note : If instead of by default value "Total" , we want to put
our own string "SUM" , then you have to do the following:


...|addcoltotals date_second labelfield="NEW_FIELD" label="SUM"




*************************************************


Example -4 :



index=_internal 
| head 3 
| table date_year,date_second 
| addcoltotals date_second labelfield="date_year" label="SUM"
       


Result :


date_yeardate_second
201558
201558
201558
SUM174

Explanation :

            In this case we have put the "SUM" String in the 
            existing column "date_year" to make the report
            look beautiful and professional


Note : 'label' has no effect if 'labelfield' is not defined



Now you can effectively utilize "addcoltotals"command in your daily use to meet your requirement !!

Hope you are now comfortable in : Usage of Splunk commands : ADDCOLTOTALS

HAPPY SPLUNKING !!

1 comment:

Nasreen Basu said...

interesting information. This is just the kind of information that i had been looking for, i'm already your rss reader now and i would regularly watch out for the new posts,Thanks a million once again, Regards,servicenow training in hyderabad ,splunk training in hyderabad , cornish hen recipe