Splunk Search

How to display the values of a field in a chart, not the count of the number of events?

MENININHU
Engager

Hello ! I have a field called Total Value that contains currency values ​​.

I want to use these values ​​in my chart , however Splunk is counting the events , and not the values ​​themselves .

How do I change this ? For example : Value = Total Value

btt
Path Finder

Hello
if your problem is to display values of the field Total values in your chart use a values() fonction after renaming Total values as Total_values
|chart values(Toatal_values)

0 Karma

somesoni2
Revered Legend

Can you post some sample events and may be current non-working search? Also, expected output.

0 Karma
Get Updates on the Splunk Community!

Routing logs with Splunk OTel Collector for Kubernetes

The Splunk Distribution of the OpenTelemetry (OTel) Collector is a product that provides a way to ingest ...

New This Month - Observability Updates Give Extended Visibility and Improve User ...

This month is a collection of special news! From Magic Quadrant updates to AppDynamics integrations to ...

Intro to Splunk Synthetic Monitoring

In our last post, we mentioned that the 3 key pieces of observability – metrics, logs, and traces – provide ...