Splunk Search

visualize stats(sum)

splunk_novice99
Explorer

Hello Splunkers

I can use stats count and visualize the output as a single value so its nice and big in that panel in my dashboard.

Is there a way to visualize the output from stats(sum) in a similar way.  Or just make the the single value in a field big and prominent in the dashboard?

|fields total|fieldformat "total" = round(total, 2)
| appendpipe
[ stats sum(total) as Grand_Total ]
|fields Grand_Total

output
------------------------------------
Grand_Total
103

Labels (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

It doesn't matter to the Single Value viz (or any other viz for that matter) what the search was, it just visualises the result events appropriately, so, if your search uses sum() or count(), at the end of it you specify only one field, the Single Value viz will visualise this.

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust

It doesn't matter to the Single Value viz (or any other viz for that matter) what the search was, it just visualises the result events appropriately, so, if your search uses sum() or count(), at the end of it you specify only one field, the Single Value viz will visualise this.

splunk_novice99
Explorer

Thanks for your reply.  Yes, I had extra values in the output.  Once output was one single value it worked perfectly.  Thanks

0 Karma

richgalloway
SplunkTrust
SplunkTrust

The value in a Single Value viz scales automatically based on its size.  If you need a bigger image, make the panel bigger.

---
If this reply helps you, Karma would be appreciated.

splunk_novice99
Explorer

Thanks for your reply.  Yes it scales how I want it to once I actually had a single value in the output.   

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...