Splunk Search

How to always display last (summary) row in table?

dehtallyutedeh
Explorer

I have a list of results in a table that spans on different pages.

*first page*

Col 1          Col2          Summary
apples         12
grapes         8
....

*last page*
cherries       20
               40             Summary

I used the addcoltotal function to get the "Summary" row.
The "summary" row only displays on the last page.
I'd like to now know if it's possible to always have the "Summary" row displayed as I navigate throughout the the pages in my table.

Thanks.

maciep
Champion

you could also add another column for the total instead of using addcoltotals.

... | eventstats sum(Col2) as Summary

It might also be possible to put the total in the panel title? Maybe?

0 Karma

DalJeanis
Legend

Yes, it's possible, but you need to do it a different way.

Your list of results needs to be the base search, and then you will have two panels. The first panel will display your details, basically the whole results of the base search, and the second panel will display your totals of the records in the base search.

0 Karma
Get Updates on the Splunk Community!

Join Us for Splunk University and Get Your Bootcamp Game On!

If you know, you know! Splunk University is the vibe this summer so register today for bootcamps galore ...

.conf24 | Learning Tracks for Security, Observability, Platform, and Developers!

.conf24 is taking place at The Venetian in Las Vegas from June 11 - 14. Continue reading to learn about the ...

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...