total a column in OMS

%3CLINGO-SUB%20id%3D%22lingo-sub-145871%22%20slang%3D%22en-US%22%3Etotal%20a%20column%20in%20OMS%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-145871%22%20slang%3D%22en-US%22%3E%3CP%3EHello%2C%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EHow%20can%20I%20sum%20a%20column%3F%3C%2FP%3E%0A%3CP%3EI%20have%20each%20row%20dcount%20with%20number%20of%20customers%20and%20I%20would%20like%20to%20know%20what%20is%20the%20total%20of%20customers.%3C%2FP%3E%0A%3CP%3EI%20want%20to%20present%20a%20new%20row%20with%20the%20total%20number%20of%20customers%3C%2FP%3E%0A%3CP%3Eor%20even%20a%20new%20column%20that%20shows%20the%20same%20number%20on%20each%20row..%20(I%20dont%20mind%20how%20the%20visualisiation%20will%20look%20like%2C%20need%20the%20total%20number)%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EThanks!%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-145871%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3EAzure%20Log%20Analytics%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3EQuery%20Language%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-147170%22%20slang%3D%22en-US%22%3ERe%3A%20total%20a%20column%20in%20OMS%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-147170%22%20slang%3D%22en-US%22%3E%3CP%3EJust%20keep%20in%20mind%2C%20that%20you%20cannot%20really%20sum%20a%20dcount%2C%20unless%20you%20know%20that%20each%20row%20is%20actually%20is%20mutually%20exclusive.%26nbsp%3B%20If%20you%20can%20expand%20on%20your%20scenario%20there%20could%20be%20other%20options%20(for%20e.g.%20you%20may%20have%20to%20use%20%3CA%20href%3D%22https%3A%2F%2Fdocs.loganalytics.io%2Fdocs%2FLanguage-Reference%2FScalar-functions%2Fdcount_hll()%22%20target%3D%22_blank%22%20rel%3D%22nofollow%20noopener%20noreferrer%22%3Edcount_hll%3C%2FA%3E%20and%20%3CA%20href%3D%22https%3A%2F%2Fdocs.loganalytics.io%2Fdocs%2FLanguage-Reference%2FAggregation-functions%2Fhll_merge()%22%20target%3D%22_blank%22%20rel%3D%22nofollow%20noopener%20noreferrer%22%3Ehll_merge%3C%2FA%3E%20)%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-146277%22%20slang%3D%22en-US%22%3ERe%3A%20total%20a%20column%20in%20OMS%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-146277%22%20slang%3D%22en-US%22%3E%3CP%3Eok%2C%20that%20second%20option%20I%20added%20is%20for%20that%20use%20case.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-146222%22%20slang%3D%22en-US%22%3ERe%3A%20total%20a%20column%20in%20OMS%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-146222%22%20slang%3D%22en-US%22%3E%3CP%3EHi%20Noa%2C%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EThanks%2C%20but%20when%20I%20do%20this%3C%2FP%3E%0A%3CPRE%3E%7C%20summarize%20dcount(Product)%20by%20Computer%0A%7C%20summarize%20sum_dcount%3Dsum(dcount_Product)%3C%2FPRE%3E%0A%3CP%3EIts%20the%20only%20thing%20that%20displayed.%3C%2FP%3E%0A%3CP%3EI%20want%20to%20continue%20and%20display%20all%20the%20results%20%2B%20the%20total%20in%20the%20same%20table%2Fview.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-146067%22%20slang%3D%22en-US%22%3ERe%3A%20total%20a%20column%20in%20OMS%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-146067%22%20slang%3D%22en-US%22%3E%3CP%3EHi%20Tal%2C%3C%2FP%3E%0A%3CP%3ETo%20only%20get%20the%20sum%20of%20the%20dcount%20value%2C%20you%20can%20do%20something%20like%20the%20bottom%20line%20here%3A%3C%2FP%3E%0A%3CPRE%3EUpdate%0A%7C%20summarize%20dcount(Product)%20by%20Computer%0A%7C%20summarize%20sum_dcount%3Dsum(dcount_Product)%3C%2FPRE%3E%0A%3CP%3ETo%20add%20the%20summed%20value%20to%20each%20row%2C%20you%20can%20do%20this%3A%3C%2FP%3E%0A%3CPRE%3Elet%20summed_dcount_products_by_computer%3D%0AUpdate%0A%7C%20summarize%20dcount(Product)%20by%20Computer%0A%7C%20summarize%20sum_dcount%3Dsum(dcount_Product)%3B%0AUpdate%0A%7C%20extend%20summed_dcount%3Dtoscalar(summed_dcount_products_by_computer)%3C%2FPRE%3E%0A%3CP%3EHTH%2C%3C%2FP%3E%0A%3CP%3ENoa%3C%2FP%3E%3C%2FLINGO-BODY%3E
Occasional Contributor

Hello,

 

How can I sum a column?

I have each row dcount with number of customers and I would like to know what is the total of customers.

I want to present a new row with the total number of customers

or even a new column that shows the same number on each row.. (I dont mind how the visualisiation will look like, need the total number)

 

Thanks!

4 Replies

Hi Tal,

To only get the sum of the dcount value, you can do something like the bottom line here:

Update
| summarize dcount(Product) by Computer
| summarize sum_dcount=sum(dcount_Product)

To add the summed value to each row, you can do this:

let summed_dcount_products_by_computer=
Update
| summarize dcount(Product) by Computer
| summarize sum_dcount=sum(dcount_Product);
Update
| extend summed_dcount=toscalar(summed_dcount_products_by_computer)

HTH,

Noa

Hi Noa,

 

Thanks, but when I do this

| summarize dcount(Product) by Computer
| summarize sum_dcount=sum(dcount_Product)

Its the only thing that displayed.

I want to continue and display all the results + the total in the same table/view.

 

ok, that second option I added is for that use case.

Just keep in mind, that you cannot really sum a dcount, unless you know that each row is actually is mutually exclusive.  If you can expand on your scenario there could be other options (for e.g. you may have to use dcount_hll and hll_merge