https://community.splunk.com/t5/Splunk-Search/How-to-specify-a-particular-aggregate-value-in-query-for-Single/m-p/414442#M119408 <P>hi @dkeck! i appended that to the end of the query but it's only displaying "1"</P> Sat, 19 Jan 2019 19:45:33 GMT jaj 2019-01-19T19:45:33Z https://community.splunk.com/t5/Splunk-Search/How-to-specify-a-particular-aggregate-value-in-query-for-Single/m-p/414440#M119406 <P>how do i specify a particular value to be displayed in single value visualization chart? i only want the totalCount (success+errors) to display as the single value in the chart:</P> <PRE><CODE>index=nonprod_applogs source="*test.log*" ("purchase success") OR ("purchase failed") | dedup requestMarker | stats count(eval(searchmatch("purchase success"))) as successCount count(eval(searchmatch("purchase failed"))) as errorCount | eval totalCount = successCount + errorCount </CODE></PRE> Sat, 19 Jan 2019 19:35:22 GMT https://community.splunk.com/t5/Splunk-Search/How-to-specify-a-particular-aggregate-value-in-query-for-Single/m-p/414440#M119406 jaj 2019-01-19T19:35:22Z https://community.splunk.com/t5/Splunk-Search/How-to-specify-a-particular-aggregate-value-in-query-for-Single/m-p/414441#M119407 <P>HI,</P> <P>I want to rewrite my previous answer:</P> <P>try this. either add to your XML code on your dashboard the option <CODE>field</CODE> have a look at the link under "single value"</P> <P><A href="https://docs.splunk.com/Documentation/Splunk/7.2.3/Viz/PanelreferenceforSimplifiedXML#single_value">https://docs.splunk.com/Documentation/Splunk/7.2.3/Viz/PanelreferenceforSimplifiedXML#single_value</A></P> <P>or use the SPL command <CODE>| fields totalCount</CODE> within your single value search on the dashboard</P> Sat, 19 Jan 2019 19:40:43 GMT https://community.splunk.com/t5/Splunk-Search/How-to-specify-a-particular-aggregate-value-in-query-for-Single/m-p/414441#M119407 dkeck 2019-01-19T19:40:43Z https://community.splunk.com/t5/Splunk-Search/How-to-specify-a-particular-aggregate-value-in-query-for-Single/m-p/414442#M119408 <P>hi @dkeck! i appended that to the end of the query but it's only displaying "1"</P> Sat, 19 Jan 2019 19:45:33 GMT https://community.splunk.com/t5/Splunk-Search/How-to-specify-a-particular-aggregate-value-in-query-for-Single/m-p/414442#M119408 jaj 2019-01-19T19:45:33Z https://community.splunk.com/t5/Splunk-Search/How-to-specify-a-particular-aggregate-value-in-query-for-Single/m-p/414443#M119409 <P>updated my answer <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> Sat, 19 Jan 2019 19:54:31 GMT https://community.splunk.com/t5/Splunk-Search/How-to-specify-a-particular-aggregate-value-in-query-for-Single/m-p/414443#M119409 dkeck 2019-01-19T19:54:31Z https://community.splunk.com/t5/Splunk-Search/How-to-specify-a-particular-aggregate-value-in-query-for-Single/m-p/414444#M119410 <P>@jaj why not try just <CODE>| stats count as totalCount</CODE>? You have already filtered the required events:</P> <PRE><CODE>index=nonprod_applogs source="*test.log*" ("purchase success") OR ("purchase failed") | dedup requestMarker | stats count as totalCount </CODE></PRE> Sat, 19 Jan 2019 20:14:41 GMT https://community.splunk.com/t5/Splunk-Search/How-to-specify-a-particular-aggregate-value-in-query-for-Single/m-p/414444#M119410 niketn 2019-01-19T20:14:41Z https://community.splunk.com/t5/Splunk-Search/How-to-specify-a-particular-aggregate-value-in-query-for-Single/m-p/414445#M119411 <P>@niketnilay dang yes very true for totalCount thank you :bow:</P> Sat, 19 Jan 2019 20:21:23 GMT https://community.splunk.com/t5/Splunk-Search/How-to-specify-a-particular-aggregate-value-in-query-for-Single/m-p/414445#M119411 jaj 2019-01-19T20:21:23Z https://community.splunk.com/t5/Splunk-Search/How-to-specify-a-particular-aggregate-value-in-query-for-Single/m-p/414446#M119412 <P>@dkeck cool thanks for the amended response! :thumbsup:</P> Sat, 19 Jan 2019 20:22:38 GMT https://community.splunk.com/t5/Splunk-Search/How-to-specify-a-particular-aggregate-value-in-query-for-Single/m-p/414446#M119412 jaj 2019-01-19T20:22:38Z