Sure, it can be done but you have to do it in one query and then select the fields in the field selector. Try this: { "visualizations": { "viz_L1aSlLpB": { "type": "splunk.singlevalue", "dataSources": { "primary": "ds_HbMCf42K" }, "title": "field1" }, "viz_gpsfTDga": { "type": "splunk.singlevalue", "options": { "majorValue": "> sparklineValues | lastPoint()", "trendValue": "> sparklineValues | delta(-2)", "sparklineValues": "> primary | seriesByName('field3')" }, "dataSources": { "primary": "ds_HOFmRc1r_ds_HbMCf42K" }, "title": "field3" }, "viz_gAmWIokL": { "type": "splunk.singlevalue", "options": { "majorValue": "> sparklineValues | lastPoint()", "trendValue": "> sparklineValues | delta(-2)", "sparklineValues": "> primary | seriesByName('field2')" }, "dataSources": { "primary": "ds_Epg28xu5_ds_HOFmRc1r_ds_HbMCf42K" }, "title": "field2" }, "viz_3gzCc3Pv": { "type": "splunk.singlevalue", "options": { "majorValue": "> sparklineValues | lastPoint()", "trendValue": "> sparklineValues | delta(-2)", "sparklineValues": "> primary | seriesByName('Total')" }, "dataSources": { "primary": "ds_WVxE4sTM_ds_HOFmRc1r_ds_HbMCf42K" }, "title": "total" } }, "dataSources": { "ds_HbMCf42K": { "type": "ds.search", "options": { "query": "| makeresults\n| fields - _time\n| eval field1= 1\n| eval field2= 2\n| eval field3= 3\n| addtotals" }, "name": "Search_1" }, "ds_HOFmRc1r_ds_HbMCf42K": { "type": "ds.search", "options": { "query": "| makeresults\n| fields - _time\n| eval field1= 1\n| eval field2= 2\n| eval field3= 3\n| addtotals" }, "name": "Copy of Search_1" }, "ds_Epg28xu5_ds_HOFmRc1r_ds_HbMCf42K": { "type": "ds.search", "options": { "query": "| makeresults\n| fields - _time\n| eval field1= 1\n| eval field2= 2\n| eval field3= 3\n| addtotals" }, "name": "Copy of Copy of Search_1" }, "ds_WVxE4sTM_ds_HOFmRc1r_ds_HbMCf42K": { "type": "ds.search", "options": { "query": "| makeresults\n| fields - _time\n| eval field1= 1\n| eval field2= 2\n| eval field3= 3\n| addtotals" }, "name": "Copy of Copy of Search_1" }, "ds_6sMlf8EL_ds_Epg28xu5_ds_HOFmRc1r_ds_HbMCf42K": { "type": "ds.search", "options": { "query": "| makeresults\n| fields - _time\n| eval field1= 1\n| eval field2= 2\n| eval field3= 3\n| addtotals" }, "name": "Copy of Copy of Copy of Search_1" } }, "defaults": { "dataSources": { "ds.search": { "options": { "queryParameters": { "latest": "$global_time.latest$", "earliest": "$global_time.earliest$" } } } } }, "inputs": { "input_global_trp": { "type": "input.timerange", "options": { "token": "global_time", "defaultValue": "-24h@h,now" }, "title": "Globale Zeitspanne" } }, "layout": { "type": "absolute", "options": { "display": "auto-scale" }, "structure": [ { "item": "viz_L1aSlLpB", "type": "block", "position": { "x": 120, "y": 160, "w": 200, "h": 130 } }, { "item": "viz_gpsfTDga", "type": "block", "position": { "x": 550, "y": 160, "w": 200, "h": 130 } }, { "item": "viz_gAmWIokL", "type": "block", "position": { "x": 340, "y": 160, "w": 200, "h": 130 } }, { "item": "viz_3gzCc3Pv", "type": "block", "position": { "x": 340, "y": 10, "w": 200, "h": 130 } } ], "globalInputs": [ "input_global_trp" ] }, "description": "", "title": "test" }
... View more
