I was struggling with the same task and went down the rabbit hole trying out every known command. The example in the dashboard studio is unfortunately not correct. Timewrap looks like it could work, but splunk somehow gets confused with it in the foreach command. This is what i came up with: ``` aggregation over month ``` | eval month = strftime(_time, "%Y-%m") | stats count by month ``` transposing to to get it into right format and adding totals below``` | transpose 0 header_field=month | addcoltotals ``` shifting everything one column to the right if the "column" field is not emty ``` | eval p = "" | foreach 20* [ eval v = '<<FIELD>>', <<FIELD>> = if(isnotnull(column), p, '<<FIELD>>'), p = if(isnotnull(column), v, p) ] | fields - p v ``` splunk NEEDS a _time field for Trellis to work. No idea why ``` | eval _time = now() | table _time 20*     make sure to disable the sparkline and change the trend to percentage.  ... View more

^ this worked for me ... View more

Yeah this seems to mitigate the problem.  Unfortunatly if you are using chrome you have to change your global system settings.  I hope this will get patched in the next update. ... View more

Correct Answer here. This now also works in Splunk Enterprise 9.0.   Unfortunately there is no way yet to add both via the GUI and you have to go into the Code Editor to add the other Part. ... View more

The font size on Dashboards in absolute mode is determined by the amount of pixels you give the dashboard canvas. Click on the background canvas options and change the resolution to your liking: As a starting point, Splunk suggests 1200x720px which is too small for most applications. just change it to 1920x 1000px and your font will be smaller.    ... View more

Hi Norbert, glad I was able to help you even after over a year. Please select my answer as the solution 🙂 greetings, Max ... View more

Sure, it can be done but you have to do it in one query and then select the fields in the field selector. Try this:   {     "visualizations": {         "viz_L1aSlLpB": {             "type": "splunk.singlevalue",             "dataSources": {                 "primary": "ds_HbMCf42K"             },             "title": "field1"         },         "viz_gpsfTDga": {             "type": "splunk.singlevalue",             "options": {                 "majorValue": "> sparklineValues | lastPoint()",                 "trendValue": "> sparklineValues | delta(-2)",                 "sparklineValues": "> primary | seriesByName('field3')"             },             "dataSources": {                 "primary": "ds_HOFmRc1r_ds_HbMCf42K"             },             "title": "field3"         },         "viz_gAmWIokL": {             "type": "splunk.singlevalue",             "options": {                 "majorValue": "> sparklineValues | lastPoint()",                 "trendValue": "> sparklineValues | delta(-2)",                 "sparklineValues": "> primary | seriesByName('field2')"             },             "dataSources": {                 "primary": "ds_Epg28xu5_ds_HOFmRc1r_ds_HbMCf42K"             },             "title": "field2"         },         "viz_3gzCc3Pv": {             "type": "splunk.singlevalue",             "options": {                 "majorValue": "> sparklineValues | lastPoint()",                 "trendValue": "> sparklineValues | delta(-2)",                 "sparklineValues": "> primary | seriesByName('Total')"             },             "dataSources": {                 "primary": "ds_WVxE4sTM_ds_HOFmRc1r_ds_HbMCf42K"             },             "title": "total"         }     },     "dataSources": {         "ds_HbMCf42K": {             "type": "ds.search",             "options": {                 "query": "| makeresults\n| fields - _time\n| eval field1= 1\n| eval field2= 2\n| eval field3= 3\n| addtotals"             },             "name": "Search_1"         },         "ds_HOFmRc1r_ds_HbMCf42K": {             "type": "ds.search",             "options": {                 "query": "| makeresults\n| fields - _time\n| eval field1= 1\n| eval field2= 2\n| eval field3= 3\n| addtotals"             },             "name": "Copy of Search_1"         },         "ds_Epg28xu5_ds_HOFmRc1r_ds_HbMCf42K": {             "type": "ds.search",             "options": {                 "query": "| makeresults\n| fields - _time\n| eval field1= 1\n| eval field2= 2\n| eval field3= 3\n| addtotals"             },             "name": "Copy of Copy of Search_1"         },         "ds_WVxE4sTM_ds_HOFmRc1r_ds_HbMCf42K": {             "type": "ds.search",             "options": {                 "query": "| makeresults\n| fields - _time\n| eval field1= 1\n| eval field2= 2\n| eval field3= 3\n| addtotals"             },             "name": "Copy of Copy of Search_1"         },         "ds_6sMlf8EL_ds_Epg28xu5_ds_HOFmRc1r_ds_HbMCf42K": {             "type": "ds.search",             "options": {                 "query": "| makeresults\n| fields - _time\n| eval field1= 1\n| eval field2= 2\n| eval field3= 3\n| addtotals"             },             "name": "Copy of Copy of Copy of Search_1"         }     },     "defaults": {         "dataSources": {             "ds.search": {                 "options": {                     "queryParameters": {                         "latest": "$global_time.latest$",                         "earliest": "$global_time.earliest$"                     }                 }             }         }     },     "inputs": {         "input_global_trp": {             "type": "input.timerange",             "options": {                 "token": "global_time",                 "defaultValue": "-24h@h,now"             },             "title": "Globale Zeitspanne"         }     },     "layout": {         "type": "absolute",         "options": {             "display": "auto-scale"         },         "structure": [             {                 "item": "viz_L1aSlLpB",                 "type": "block",                 "position": {                     "x": 120,                     "y": 160,                     "w": 200,                     "h": 130                 }             },             {                 "item": "viz_gpsfTDga",                 "type": "block",                 "position": {                     "x": 550,                     "y": 160,                     "w": 200,                     "h": 130                 }             },             {                 "item": "viz_gAmWIokL",                 "type": "block",                 "position": {                     "x": 340,                     "y": 160,                     "w": 200,                     "h": 130                 }             },             {                 "item": "viz_3gzCc3Pv",                 "type": "block",                 "position": {                     "x": 340,                     "y": 10,                     "w": 200,                     "h": 130                 }             }         ],         "globalInputs": [             "input_global_trp"         ]     },     "description": "",     "title": "test" } ... View more