https://community.splunk.com/t5/Splunk-Search/How-to-Calculate-the-sum-of-values-from-a-chart-and-create-a/m-p/90314#M23204 <P>Hmm.. The timechart is the way which i am doing as of now. But I am trying to see if I can actually use multiple visualizations on a single dashboard. Like a bar chart mentioning the total count of incidents and then a line chart upon the bar chart which graphs according to number of incidents and the priority of the incident.</P> Mon, 15 Oct 2012 15:51:50 GMT theouhuios 2012-10-15T15:51:50Z https://community.splunk.com/t5/Splunk-Search/How-to-Calculate-the-sum-of-values-from-a-chart-and-create-a/m-p/90310#M23200 <P>Hello</P> <P>I am trying to create a total of values in different fields and add it to the output as a different field. I am able to get the value of different fields but got stuck on how to add them.</P> <PRE><CODE>sourcetype="xxxx" earliest=-31d@d latest=@d| dedup record.incidentId |stats count by record.priority| </CODE></PRE> <P>This is the command which I used to get the data. The data now is </P> <PRE><CODE>record.priority count 1 6 2 7568 3 6346 4 68 </CODE></PRE> <P>Now I wanted to add another field with a total of all the count values in the same chart.</P> <P>Anyone has an idea on how to do that? Is there any other method where I can first get the whole total of the count in a bar chart for a 31 day period and then probably draw the graph with different priority fields which gives the information about each priority with a count of incidents created per day?</P> <P>Regards</P> <P>-theou </P> Mon, 15 Oct 2012 14:51:10 GMT https://community.splunk.com/t5/Splunk-Search/How-to-Calculate-the-sum-of-values-from-a-chart-and-create-a/m-p/90310#M23200 theouhuios 2012-10-15T14:51:10Z https://community.splunk.com/t5/Splunk-Search/How-to-Calculate-the-sum-of-values-from-a-chart-and-create-a/m-p/90311#M23201 <P>You should probably look at the <CODE>addcoltotals</CODE> command;</P> <PRE><CODE>your_search_here | addcoltotals labelfield=record.priority label="Total count" </CODE></PRE> <P>See the docs here: <BR /> <A href="http://docs.splunk.com/Documentation/Splunk/4.3.4/SearchReference/Addcoltotals">http://docs.splunk.com/Documentation/Splunk/4.3.4/SearchReference/Addcoltotals</A></P> <P>For the second part of your query, I don't really understand how you want the output, but try;</P> <PRE><CODE>sourcetype="xxxx" earliest=-31d@d latest=@d| dedup record.incidentId | timechart span=1d count by record.priority </CODE></PRE> <P>You can paste the search (or write a new one from scratch) into the Advanced Charting view (under the "Dashboards &amp; Views" menu), and play around with the visualization options.</P> <P>Hope this helps,</P> <P>Kristian</P> Mon, 15 Oct 2012 15:22:16 GMT https://community.splunk.com/t5/Splunk-Search/How-to-Calculate-the-sum-of-values-from-a-chart-and-create-a/m-p/90311#M23201 kristian_kolb 2012-10-15T15:22:16Z https://community.splunk.com/t5/Splunk-Search/How-to-Calculate-the-sum-of-values-from-a-chart-and-create-a/m-p/90312#M23202 <P>that or <CODE>eventstats</CODE></P> Mon, 15 Oct 2012 15:28:15 GMT https://community.splunk.com/t5/Splunk-Search/How-to-Calculate-the-sum-of-values-from-a-chart-and-create-a/m-p/90312#M23202 gkanapathy 2012-10-15T15:28:15Z https://community.splunk.com/t5/Splunk-Search/How-to-Calculate-the-sum-of-values-from-a-chart-and-create-a/m-p/90313#M23203 <P>true, <CODE>addcoltotals</CODE> does not create a new field per se, but I gathered that the real request was more for presentation purposes.</P> Mon, 15 Oct 2012 15:33:56 GMT https://community.splunk.com/t5/Splunk-Search/How-to-Calculate-the-sum-of-values-from-a-chart-and-create-a/m-p/90313#M23203 kristian_kolb 2012-10-15T15:33:56Z https://community.splunk.com/t5/Splunk-Search/How-to-Calculate-the-sum-of-values-from-a-chart-and-create-a/m-p/90314#M23204 <P>Hmm.. The timechart is the way which i am doing as of now. But I am trying to see if I can actually use multiple visualizations on a single dashboard. Like a bar chart mentioning the total count of incidents and then a line chart upon the bar chart which graphs according to number of incidents and the priority of the incident.</P> Mon, 15 Oct 2012 15:51:50 GMT https://community.splunk.com/t5/Splunk-Search/How-to-Calculate-the-sum-of-values-from-a-chart-and-create-a/m-p/90314#M23204 theouhuios 2012-10-15T15:51:50Z https://community.splunk.com/t5/Splunk-Search/How-to-Calculate-the-sum-of-values-from-a-chart-and-create-a/m-p/90315#M23205 <P>Used the addtotals <FIELDS> command to get a total value. Then used fields to remove the redundant fields which weren't needed. </FIELDS></P> <P>Thanks for all your help.</P> Mon, 15 Oct 2012 19:04:49 GMT https://community.splunk.com/t5/Splunk-Search/How-to-Calculate-the-sum-of-values-from-a-chart-and-create-a/m-p/90315#M23205 theouhuios 2012-10-15T19:04:49Z