https://community.splunk.com/t5/Splunk-Search/How-do-I-append-a-column-to-a-chart/m-p/332196#M98838 <P>This worked exactly the way I needed. Thank you!</P> Wed, 25 Oct 2017 12:32:30 GMT j_partsch 2017-10-25T12:32:30Z https://community.splunk.com/t5/Splunk-Search/How-do-I-append-a-column-to-a-chart/m-p/332194#M98836 <P>I have the following search</P> <P>index=firewall policy_name="/Common/default" request_status=blocked (violations="Access from malicious IP address" OR violations="Web scraping detected") | chart count over date_mday by violations</P> <P>which gives the following chart<BR /> date_mday Access from malicious IP address Web scraping detected<BR /> 14 18951 65<BR /> 15 16891 176<BR /> but what I want is<BR /> date_mday Access from malicious IP address Web scraping detected Total<BR /> 14 18951 65 19016<BR /> 15 16891 176 17067</P> Tue, 29 Sep 2020 16:27:46 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-append-a-column-to-a-chart/m-p/332194#M98836 j_partsch 2020-09-29T16:27:46Z https://community.splunk.com/t5/Splunk-Search/How-do-I-append-a-column-to-a-chart/m-p/332195#M98837 <P>I think this should do it:<BR /> <CODE>| addtotals "Access from malicious IP address" "Web scraping detected" fieldname=Total</CODE></P> Tue, 24 Oct 2017 19:19:32 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-append-a-column-to-a-chart/m-p/332195#M98837 elliotproebstel 2017-10-24T19:19:32Z https://community.splunk.com/t5/Splunk-Search/How-do-I-append-a-column-to-a-chart/m-p/332196#M98838 <P>This worked exactly the way I needed. Thank you!</P> Wed, 25 Oct 2017 12:32:30 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-append-a-column-to-a-chart/m-p/332196#M98838 j_partsch 2017-10-25T12:32:30Z