Splunk Search

How can I display ONLY the overlay Total on a visualization?

johnward4
Communicator

I'm trying to figure out how to display just the Total for an overlay instead of displaying the value of each stacked column in my visualization. (Better illustrated in my attached photo). I'm using a | addtotals in my query that counts the "Total" value of the data which I'm showing by Month.

alt text

0 Karma

mdsnmss
SplunkTrust
SplunkTrust

When you use | addtotals it creates a new Total field. You should be able to reduce values over which you visualize simply by limiting the fields in the search. Try adding | fields Month Total to the end of your search. You may have to adjust for fieldnames. If that doesn't work, could you post the search you are using so we can take a closer look?

0 Karma

FrankVl
Ultra Champion

If you just want to display the totals, you can simply drop the by-clause. I think he still wants to see the detailed stacked bars though, but wants to show the numeric values only for the totals overlay. @johnward4 correct me if I'm wrong on that.
I had a quick look at the available visualization settings but can't really find a way to do that. Only options seem to be not display any numbers, display only overall min/max and display all values.

0 Karma

johnward4
Communicator

@niketnilay I noticed your informative answer on a comparable question

https://answers.splunk.com/answers/586657/how-can-i-format-a-chart-to-show-values-cleanly-wi.html

Do you know if there's a way to just represent the Total value by Month above each of my stacked columns? using minmax showed the max Total based on my search window of the past 6 months.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability as Code: From Zero to Dashboard

For the details on what Self-Service Observability and Observability as Code is, we have some awesome content ...

[Puzzles] Solve, Learn, Repeat: Character substitutions with Regular Expressions

This challenge was first posted on Slack #puzzles channelFor BORE at .conf23, we had a puzzle question which ...

Shape the Future of Splunk: Join the Product Research Lab!

Join the Splunk Product Research Lab and connect with us in the Slack channel #product-research-lab to get ...