Splunk Search

How to get the total sum value and top 10 values in same timechart

vrmandadi
Builder

I am trying to get the top 10 users based on GB used in a timechart graph visualization and  also the the total GB used  for the whole day  (sum(gb) as gb)in the timechart... addcoltotals will give the total for the top 10 but I want the sum for the whole day of all users not just top 10 .How can I show in timechart sum of gb line along with the other timechart

 

| tstats count FROM datamodel=ab groupby user src dest gb _time
| fields *
| timechart sum(gb) as gb by dest limit=20 useother=f
| sort -gb
| head 20

Labels (2)
0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...