There are times when a report is more valuable and comprehensive when columns of numeric data include a “total” entry, such as you might find in a spreadsheet, report, or invoice. The Splunk “addcoltotals” command provides the ability to easily include this summation in search results. In this article, we’ll investigate the use of the addcoltotals command and provide some examples of its use.

What is Splunk addcoltotals?

As the name of the command implies, this command simply adds up the numerical value total of a selected column. This can be used for a single or multi-value numerical result, and it is as easy as adding  “| addcoltotals”  to the end of a command.

The Benefits of Splunk addcoltotals

• Save time and effort: The command saves time and effort by automatically adding total of a selected column, eliminating the need to manually calculate.
• Customizable: By default, the label for the totals row will be “Total,” but the command allows users to choose the columns they want to add totals for, as well as customize the label for the summation.

How to Use the Splunk addcoltotals Command

As previously mentioned, this command organizes numeric data and is simplistic in its use.

Consider the following search that will track transaction failures by cellular carrier:

sourcetype=”mint:network” statusCode>200 failed=true | stats count AS Failures BY carrier

The results are as follows:

You can see that there are values associated with the report. By adding | addcoltotals at the end of the command, the total number of failures is easily recognized.

sourcetype=”mint:network” statusCode>200 failed=true | stats count AS Failures BY carrier | addcoltotals

Now someone who uses this report will recognize the total number of failures that customers are experiencing over all cellular carriers.

With searches with more than one numerical column, addcoltotals will add both. In this search:

sourcetype=”mint:network” statusCode=*| stats count(eval(match(failed,”False”))) AS Successes, count(eval(match(failed,”True”))) AS Failures BY carrier| addcoltotals

These search results total the Successful and Failures of sales transactions per carrier. There is also an option to create a label for the totals. Adding the qualifier “labelfield=” will accomplish this:

sourcetype=”mint:network” statusCode=*| stats count(eval(match(failed,”False”))) AS Successes, count(eval(match(failed,”True”))) AS Failures BY carrier| addcoltotals labelfield=”Total Failures”

Conclusion

In summary, “addcoltotals” command is a powerful command in Splunk that allows users to add up the total of a column or columns quickly and easily. Its functionality enhances the capabilities of Splunk, making it an indispensable tool for companies that rely on data-driven insights to drive success.

If you found this helpful…

You don’t have to master Splunk by yourself in order to get the most value out of it. Small, day-to-day optimizations of your environment can make all the difference in how you understand and use the data in your Splunk environment to manage all the work on your plate.

Cue Atlas Assessment: Instantly see where your Splunk environment is excelling and opportunities for improvement. From download to results, the whole process takes less than 30 minutes using the button below: