Splunk Search

How can in add total row runtime in Pie chart?

Path Finder

Hello,

I am drawing pie chart with different guest names using timechart. I need to display total power consumption row after pie chart .
i have used addtotal in my query but it is not working

My query is : index="power" sourcetype="powerusage" | eval guest=ltrim(source,"C:\opt\app\") | eval guest=split(guest,"\") | eval guest=mvindex(guest,-3) | addtotals col=t labelfield=Powerconsumption label=ALL | chart sum(Powerconsumption) over guest | sort -sum(Powerconsumption)

Please correct me.

Thanks in advance.

Tags (1)

Builder

geetanjali,

I would not recommend including this total in the pie chart itself, but instead include a separate search w/ a SingleValue above or below the pie chart. If you are using advanced XML this could be achieved with one search and two post process modules.

See also: Add A Single Button

0 Karma