topic Re: Why am I unable to add field values over timechart? in Splunk Search

Why am I unable to add field values over timechart?

P_Orourke — Wed, 09 Mar 2022 18:37:41 GMT

Hi,

I have 2 timecharts where I need to show a TOTAL count across specified field values. The first timechart must show the total count over all field values and the 2nd timechart must show the total count over 2 field values. I am unable to incorporate a stats or eval function before the timechart function.

Here is what my timecharts currently look like:

And here is the respective XML code:

Can you please help?

Many thanks,

Patrick

Re: Why am I unable to add field values over timechart?

maciep — Fri, 11 Mar 2022 18:53:20 GMT

I'm not sure if I understand exactly what you're asking, but maybe you can use addtotals after your timehart?

... | addtotals row=t col=f labelfield="Total"

That should calcualte the total sum of any number columns in each row and store in a field called "Total", which should be present on your chart then.