How to display total counts for SUCCESS AND FAILURE in a trend

[aditsss]

Hi Everyone,

I have one requirement . I have one dashboard which is currently showing the SUCCESS AND FAILURE BUILD RESULT TREND.

I have two drop down one is for ORG NAME and other is for BUILD RESULT

So suppose I select Yesterday for all ORGS

SUCCESS COUNT - 4

FAILURE COUNT - 4

Its showing  Individually SUCCESS AND FAILURE COUNT IN THE TREND

I want one more trend that will show the complete result like that is 8

ONE TREND FOR SUCCESS - 4

ONE TREND FOR FAILURE - 4

ONE TOTAL TREND - 8

RIGHT NOW I have SUCCESS AND FAILURE  TREND in that panel.

I want one more trend along with this two trends that will show the total  of this two trend.

Below is my code

<row>
<panel>
<chart>
<title>Jenkins Builds Trending Report</title>
<search>
<query>index="abc" sourcetype="xyz" $orgname$ $buildresult$ |
timechart span=1d count(BuildResult) by BuildResult useother=f limit=25</query>
<earliest>$field4.earliest$</earliest>
<latest>$field4.latest$</latest>
</search>
<earliest>$field4.earliest$</earliest>
<latest>$field4.latest$</latest>
<sampleRatio>1</sampleRatio>
</search-->
<option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
<option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
<option name="charting.axisTitleX.text">Date</option>
<option name="charting.axisTitleX.visibility">visible</option>
<option name="charting.axisTitleY.text">Count</option>
<option name="charting.axisTitleY.visibility">visible</option>
<option name="charting.axisTitleY2.visibility">visible</option>
<option name="charting.axisX.scale">linear</option>
<option name="charting.axisY.scale">linear</option>
<option name="charting.axisY2.enabled">0</option>
<option name="charting.axisY2.scale">inherit</option>
<option name="charting.chart">line</option>
<option name="charting.chart.bubbleMaximumSize">50</option>
<option name="charting.chart.bubbleMinimumSize">10</option>
<option name="charting.chart.bubbleSizeBy">area</option>
<option name="charting.chart.nullValueMode">connect</option>
<option name="charting.chart.showDataLabels">none</option>
<option name="charting.chart.showMarkers">1</option>
<option name="charting.chart.sliceCollapsingThreshold">0.01</option>
<option name="charting.chart.stackMode">stacked</option>
<option name="charting.chart.style">shiny</option>
<option name="charting.drilldown">none</option>
<option name="charting.layout.splitSeries">0</option>
<option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
<option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
<option name="charting.legend.placement">right</option>
<option name="charting.lineDashStyle">longDash</option>
<option name="height">400</option>
<option name="trellis.enabled">0</option>
<option name="trellis.scales.shared">1</option>
<option name="trellis.size">large</option>
<option name="trellis.splitBy">OrgFolderName</option>
</chart>
</panel>
</row>

Can someone please guide me on that.

[bowesmana]

@aditsss 

Just put this after your timechart line

| addtotals

It will add up the BuildResult columns  and add a new column called Total

You can use the fieldname=X parameter to name the calculated field, otherwise it will be 'Total'.

https://docs.splunk.com/Documentation/SplunkCloud/8.1.2011/SearchReference/Addtotals

[aditsss]

@bowesmana 

Can you please guide me how can I used addtotals  in my query.

Below is my code:

<row>
<panel>
<chart>
<title>Jenkins Builds Trending Report</title>
<search>
<query>index="abc" sourcetype="xyz" $orgname$ $buildresult$ |
timechart span=1d count(BuildResult) by BuildResult useother=f limit=25</query>
<earliest>$field4.earliest$</earliest>
<latest>$field4.latest$</latest>
</search>
<earliest>$field4.earliest$</earliest>
<latest>$field4.latest$</latest>
<sampleRatio>1</sampleRatio>
</search-->
<option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
<option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
<option name="charting.axisTitleX.text">Date</option>
<option name="charting.axisTitleX.visibility">visible</option>
<option name="charting.axisTitleY.text">Count</option>
<option name="charting.axisTitleY.visibility">visible</option>
<option name="charting.axisTitleY2.visibility">visible</option>
<option name="charting.axisX.scale">linear</option>
<option name="charting.axisY.scale">linear</option>
<option name="charting.axisY2.enabled">0</option>
<option name="charting.axisY2.scale">inherit</option>
<option name="charting.chart">line</option>
<option name="charting.chart.bubbleMaximumSize">50</option>
<option name="charting.chart.bubbleMinimumSize">10</option>
<option name="charting.chart.bubbleSizeBy">area</option>
<option name="charting.chart.nullValueMode">connect</option>
<option name="charting.chart.showDataLabels">none</option>
<option name="charting.chart.showMarkers">1</option>
<option name="charting.chart.sliceCollapsingThreshold">0.01</option>
<option name="charting.chart.stackMode">stacked</option>
<option name="charting.chart.style">shiny</option>
<option name="charting.drilldown">none</option>
<option name="charting.layout.splitSeries">0</option>
<option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
<option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
<option name="charting.legend.placement">right</option>
<option name="charting.lineDashStyle">longDash</option>
<option name="height">400</option>
<option name="trellis.enabled">0</option>
<option name="trellis.scales.shared">1</option>
<option name="trellis.size">large</option>
<option name="trellis.splitBy">OrgFolderName</option>
</chart>
</panel>

[bowesmana · Accepted solution]

Your query is this

index="abc" sourcetype="xyz" $orgname$ $buildresult$ |
timechart span=1d count(BuildResult) by BuildResult useother=f limit=25

Add the following line (as in my first post

| addtotals