Calculates multiple levels of subtotals across a group of fields along with the grand total. This command creates subtotals that roll up from the most detailed level to a grand total, following a grouping field specified in the by clause.


rollup [label=VALUE] AGGR_FUNC [as ALIAS], ... [by GRP_FIELD, ...]
Required Parameters
Pairs of a aggregate function (AGGR_FUNC) and optional alias (ALIAS) as a field name, separated by a comma (,). If no alias provided, the function name is labeled as the field name, such as count() and sum(sent_pkts). It is recommended that you specify an ALIAS.
Optional Parameters
Label given to the aggregate value (default: null).
by GRP_FIELD, ...
Grouping fields with by directive, separated by a comma(,).


  1. Calculate the subtotal for each action field, and grand total.

    rollup count by action
  2. Calculate sub-totals and grand totals (the label is displayed as "TOTAL") of the count and size for the action and status fields.

    rollup label=TOTAL count, sum(size) as size by action, status