 
					
				
		
I have the following search
index=firewall policy_name="/Common/default" request_status=blocked (violations="Access from malicious IP address" OR violations="Web scraping detected") | chart count over date_mday by violations
which gives the following chart
date_mday   Access from malicious IP address    Web scraping detected
14  18951   65
15  16891   176
but what I want is
date_mday   Access from malicious IP address    Web scraping detected   Total
14  18951   65    19016
15  16891   176  17067
I think this should do it:
| addtotals "Access from malicious IP address" "Web scraping detected" fieldname=Total
I think this should do it:
| addtotals "Access from malicious IP address" "Web scraping detected" fieldname=Total
 
					
				
		
This worked exactly the way I needed. Thank you!
