Splunk Search

Add column total to timechart graph as annotation

thesmith
New Member

Hi, I have a timechart that, say, graphs successful calls over a month but it would be good to add the total for the month somewhere. addcoltotal will do this but I don't know how to add it textually to the graph and not screw up the end of the graph. I don't really mind where the total goes, as long as it's there (annotation, legend, title).

sourcetype="source" callTime>10 | timechart count | addcoltotals

I'd additionally rather not have a cumulative column as that skews the scale of the graph.

0 Karma
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

Assuming this ends up in a dashboard, have you considered using a second panel?

Alternatively, put a sideviewutils HTML module in the timechart's panel to print out the total.

View solution in original post

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Assuming this ends up in a dashboard, have you considered using a second panel?

Alternatively, put a sideviewutils HTML module in the timechart's panel to print out the total.

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Think Like an Architect: Introducing the Splunk Certified Cybersecurity Defense ...

In cybersecurity, defenders respond to threats. Architects design the systems that stop them.    As ...

Best Practices: Splunk auto adjust pipeline queue

When you enable autoAdjustQueue in Splunk, maxSize should be understood as the queue size Splunk starts with ...

Announcing Modern Navigation: A New Era of Splunk User Experience

We are excited to introduce the Modern Navigation feature in the Splunk Platform, available to both cloud and ...