https://community.splunk.com/t5/Dashboards-Visualizations/Timechart-for-addtotals-value/m-p/497446#M33468 <P>thanks you so much. It worked. \</P> Thu, 19 Mar 2020 02:30:21 GMT thomas6m 2020-03-19T02:30:21Z https://community.splunk.com/t5/Dashboards-Visualizations/Timechart-for-addtotals-value/m-p/497444#M33466 <P>Hi Team,<BR /> I am trying to create timechart addtotals value. But when I using the query, I am getting Total, others and few more lines. Please let me know how to suppress/hide all line other than addtotals (Total) value. </P> <P>index=int_gcg_apac_pcf_application_dm_169688 OR index=int_gcg_apac_pcf_foundation_dm_169688 cf_org_name=* cf_space_name=* cf_app_name=* instance_index=*|bucket _time span=1m| dedup _time cf_org_name cf_space_name cf_app_name instance_index| fields _time cf_org_name cf_space_name cf_app_name instance_index|timechart span=1m count(instance_index) by cf_app_name | addtotals </P> <P>Regards,<BR /> Tom</P> Wed, 30 Sep 2020 04:39:44 GMT https://community.splunk.com/t5/Dashboards-Visualizations/Timechart-for-addtotals-value/m-p/497444#M33466 thomas6m 2020-09-30T04:39:44Z https://community.splunk.com/t5/Dashboards-Visualizations/Timechart-for-addtotals-value/m-p/497445#M33467 <PRE><CODE>.... | fields _time Total </CODE></PRE> Wed, 18 Mar 2020 19:45:59 GMT https://community.splunk.com/t5/Dashboards-Visualizations/Timechart-for-addtotals-value/m-p/497445#M33467 to4kawa 2020-03-18T19:45:59Z https://community.splunk.com/t5/Dashboards-Visualizations/Timechart-for-addtotals-value/m-p/497446#M33468 <P>thanks you so much. It worked. \</P> Thu, 19 Mar 2020 02:30:21 GMT https://community.splunk.com/t5/Dashboards-Visualizations/Timechart-for-addtotals-value/m-p/497446#M33468 thomas6m 2020-03-19T02:30:21Z