Splunk Search

visualize stats(sum)

splunk_novice99
Explorer

Hello Splunkers

I can use stats count and visualize the output as a single value so its nice and big in that panel in my dashboard.

Is there a way to visualize the output from stats(sum) in a similar way.  Or just make the the single value in a field big and prominent in the dashboard?

|fields total|fieldformat "total" = round(total, 2)
| appendpipe
[ stats sum(total) as Grand_Total ]
|fields Grand_Total

output
------------------------------------
Grand_Total
103

Labels (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

It doesn't matter to the Single Value viz (or any other viz for that matter) what the search was, it just visualises the result events appropriately, so, if your search uses sum() or count(), at the end of it you specify only one field, the Single Value viz will visualise this.

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust

It doesn't matter to the Single Value viz (or any other viz for that matter) what the search was, it just visualises the result events appropriately, so, if your search uses sum() or count(), at the end of it you specify only one field, the Single Value viz will visualise this.

splunk_novice99
Explorer

Thanks for your reply.  Yes, I had extra values in the output.  Once output was one single value it worked perfectly.  Thanks

0 Karma

richgalloway
SplunkTrust
SplunkTrust

The value in a Single Value viz scales automatically based on its size.  If you need a bigger image, make the panel bigger.

---
If this reply helps you, Karma would be appreciated.

splunk_novice99
Explorer

Thanks for your reply.  Yes it scales how I want it to once I actually had a single value in the output.   

0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk Observability Cloud – June 2025

What’s New in Splunk Observability Cloud – June 2025 We are excited to announce the latest enhancements to ...

Almost Too Eventful Assurance: Part 2

Work While You SleepBefore you can rely on any autonomous remediation measures, you need to close the loop ...

Leveraging Detections from the Splunk Threat Research Team & Cisco Talos

 Stay ahead of today’s evolving threats with the combined power of the Splunk Threat Research Team (STRT) and ...