Splunk Search

Display Only the Total Row

IRHM73
Motivator

Hi, I wonder whether someone may be able to help me please.

With some help along the way I've written the query below:

index=main auditSource=frontend auditType=Survey detail.overall!="None" 
| replace frontend with "Overall Satisfaction" 
| rename detail.overall As "Rating" 
| replace 1 with "Very Satisfied", 2 with "Satisfied", 3 with "Neither", 4 with "Dissatisfied", 5 with "Very Dissatisfied" 
| chart count by Rating |eval "Rating Mark"=case(Rating="Very Satisfied", 100, Rating="Satisfied", 75 , Rating="Neither", 50, Rating="Dissatisfied", 25, Rating="Very Dissatisfied", 0 , 1=1, 0)  
| rename count as "Total No Of Replies" 
| eval "Rating Calculation"='Total No Of Replies' * 'Rating Mark'
| table "Rating", "Total No Of Replies", "Rating Mark", "Rating Calculation" 
| addcoltotals labelfield=Rating label="Total" 
|  eval Weighted Rating =if(Rating=="Total",tostring(round('Rating Calculation' *1 / 'Total No Of Replies',1)) + "%",null()) 
| eval Rating=(Rating) | eval sort_field=case(Rating=="Very Satisfied",1,Rating=="Satisfied",2,Rating=="Neutral",3,Rating=="Dissatisfied",4,Rating=="Very Dissatisfied",5) 
| sort sort_field 
| fields "Rating", "Total No Of Replies", "Rating Mark", "Weighted Rating"

What I'd like to do is display only the 'Total' row.

I found a link here and tried the 'fields + Total' and 'where ser=Total' solutions but I've been unable to get these to work.

I just wondered whether someone may be able to look at this please and offer some guidance on how I may achieve this.

Many thanks and kind regards

Chris

1 Solution

woodcock
Esteemed Legend

Assuming that it is the last/bottom line, probably the easiest way is like this:

... | tail 1

View solution in original post

0 Karma

woodcock
Esteemed Legend

Assuming that it is the last/bottom line, probably the easiest way is like this:

... | tail 1
0 Karma

IRHM73
Motivator

Hi @woodcock, that's fantastic, thank you for taking the time to reply to my post.

Many thanks and kind regards

Chris

0 Karma

sideview
SplunkTrust
SplunkTrust

Heads up you can also always use the search command again to filter down to just the row(s) you need, even aftert they've been grouped and transformed by other commands. eg here | search Rating=="Total" would do it too.

0 Karma

IRHM73
Motivator

Hi, thank you very much for this piece of useful information.

Kind regards

Chris

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...