Splunk Search

How can I display ONLY the overlay Total on a visualization?

johnward4
Communicator

I'm trying to figure out how to display just the Total for an overlay instead of displaying the value of each stacked column in my visualization. (Better illustrated in my attached photo). I'm using a | addtotals in my query that counts the "Total" value of the data which I'm showing by Month.

alt text

0 Karma

mdsnmss
SplunkTrust
SplunkTrust

When you use | addtotals it creates a new Total field. You should be able to reduce values over which you visualize simply by limiting the fields in the search. Try adding | fields Month Total to the end of your search. You may have to adjust for fieldnames. If that doesn't work, could you post the search you are using so we can take a closer look?

0 Karma

FrankVl
Ultra Champion

If you just want to display the totals, you can simply drop the by-clause. I think he still wants to see the detailed stacked bars though, but wants to show the numeric values only for the totals overlay. @johnward4 correct me if I'm wrong on that.
I had a quick look at the available visualization settings but can't really find a way to do that. Only options seem to be not display any numbers, display only overall min/max and display all values.

0 Karma

johnward4
Communicator

@niketnilay I noticed your informative answer on a comparable question

https://answers.splunk.com/answers/586657/how-can-i-format-a-chart-to-show-values-cleanly-wi.html

Do you know if there's a way to just represent the Total value by Month above each of my stacked columns? using minmax showed the max Total based on my search window of the past 6 months.

0 Karma
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...