Splunk Search

How to get the total sum value and top 10 values in same timechart

vrmandadi
Builder

I am trying to get the top 10 users based on GB used in a timechart graph visualization and  also the the total GB used  for the whole day  (sum(gb) as gb)in the timechart... addcoltotals will give the total for the top 10 but I want the sum for the whole day of all users not just top 10 .How can I show in timechart sum of gb line along with the other timechart

 

| tstats count FROM datamodel=ab groupby user src dest gb _time
| fields *
| timechart sum(gb) as gb by dest limit=20 useother=f
| sort -gb
| head 20

Labels (2)
0 Karma