Splunk Search

chart : Total

LauraBre
Communicator

Hello,

I want to create a line chart with the number of D2T, number of T2D,... On the same chart, I want to have a line "TOTAL" which is the sum of D2T,T2D... I tried to add the case Service_Type="D2T" OR Service_Type="T2D" OR Service_Type="EFT", "TOTAL" in "case" but it doesn't work because if we are in one of cases, the others cases don't test.

 tag::source="TokenizerWatchdogSplunk" Service_Type="*"| eval Serie=case(Service_Type="D2T", "TOK",Service_Type="T2D", "DETOK",Service_Type="EFT", "ESTABLISHMENT") | timechart count(Service_Type) as "Number of Services" by Serie

If you know the solution of the problem, thank you by advance for your solution.

Tags (1)
0 Karma

emiller42
Motivator

If you pipe your search above to | addtotals it will add a column with a summation of the row. I'm assuming this is what you're looking for?

emiller42
Motivator

Glad I could help! Do you mind accepting the answer so it shows up as such for others searching for this in the future? (Click the checkmark)

0 Karma

LauraBre
Communicator

Thx very much. It works very well.

0 Karma
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...