Splunk Search

How to always display last (summary) row in table?

dehtallyutedeh
Explorer

I have a list of results in a table that spans on different pages.

*first page*

Col 1          Col2          Summary
apples         12
grapes         8
....

*last page*
cherries       20
               40             Summary

I used the addcoltotal function to get the "Summary" row.
The "summary" row only displays on the last page.
I'd like to now know if it's possible to always have the "Summary" row displayed as I navigate throughout the the pages in my table.

Thanks.

maciep
Champion

you could also add another column for the total instead of using addcoltotals.

... | eventstats sum(Col2) as Summary

It might also be possible to put the total in the panel title? Maybe?

0 Karma

DalJeanis
SplunkTrust
SplunkTrust

Yes, it's possible, but you need to do it a different way.

Your list of results needs to be the base search, and then you will have two panels. The first panel will display your details, basically the whole results of the base search, and the second panel will display your totals of the records in the base search.

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...