Splunk Search

How to always display last (summary) row in table?

dehtallyutedeh
Explorer

I have a list of results in a table that spans on different pages.

*first page*

Col 1          Col2          Summary
apples         12
grapes         8
....

*last page*
cherries       20
               40             Summary

I used the addcoltotal function to get the "Summary" row.
The "summary" row only displays on the last page.
I'd like to now know if it's possible to always have the "Summary" row displayed as I navigate throughout the the pages in my table.

Thanks.

maciep
Champion

you could also add another column for the total instead of using addcoltotals.

... | eventstats sum(Col2) as Summary

It might also be possible to put the total in the panel title? Maybe?

0 Karma

DalJeanis
Legend

Yes, it's possible, but you need to do it a different way.

Your list of results needs to be the base search, and then you will have two panels. The first panel will display your details, basically the whole results of the base search, and the second panel will display your totals of the records in the base search.

0 Karma
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...