@ITWhisperer  you're right. Thanks ... View more

Thanks @ITWhisperer  I've used addtotals. Just one more thing left now how can I transform last  row Trend to become last column ? ... View more

Thanks @ITWhisperer  for your quick answer addtotals will give the total of the 3 columns for each row while in this case only the total of last two columns are needed. Any workaround ? Besides, transposing adds a new row in the top while I want the second row to be the first one (header) of the table. Any idea ? thanks ... View more

Awesome @livehybrid , Thanks ... View more

Thanks @ITWhisperer , it's good to know that it's doable using Classic SimpleXML Dashboard. Hopefully it will also be possible using Dashboard Studio later on. For now I'll stick with it. ... View more

Thanks @ITWhisperer  for your quick answer. I'm a bit new to Splunk, so I started straight away with dashboard studio as it's easier. So if there's a work around within dashboard studio, that would be perfect. Otherwise I'll start also looking at classic dashboard and classic SimpleXML. Is it possible to switch in both directions between classic dashboard (xml) and dashboard studio (json) ? ... View more

Hi @ITWhisperer  I'm using dashboard studio. Here is my source code { "title": "ButterCup Game", "description": "", "inputs": { "input_global_trp": { "options": { "defaultValue": "0,", "token": "global_time" }, "title": "Global Time Range", "type": "input.timerange" }, "input_wAcCA79n": { "options": { "defaultValue": "*", "items": [ { "label": "All", "value": "*" }, { "label": "ACCESSORIES", "value": "ACCESSORIES" }, { "label": "ARCADE", "value": "ARCADE" }, { "label": "SHOOTER", "value": "SHOOTER" }, { "label": "SIMULATION", "value": "SIMULATION" }, { "label": "SPORTS", "value": "SPORTS" }, { "label": "STRATEGY", "value": "STRATEGY" }, { "label": "TEE", "value": "TEE" } ], "token": "dd_token" }, "title": "Game Categories", "type": "input.dropdown" } }, "defaults": { "dataSources": { "ds.search": { "options": { "queryParameters": { "earliest": "$global_time.earliest$", "latest": "$global_time.latest$" } } } } }, "visualizations": { "viz_t3jLGiwh": { "dataSources": { "primary": "ds_V5vxqc3K" }, "title": "Sales count by product", "type": "splunk.pie" } }, "dataSources": { "ds_V5vxqc3K": { "name": "CategorySales", "options": { "query": "index=web sourcetype=\"access_combined\" status=200 product_name=* categoryId=$dd_token$\n| stats count by product_name", "queryParameters": { "earliest": "$global_time.earliest$", "latest": "$global_time.latest$" } }, "type": "ds.search" } }, "layout": { "globalInputs": [ "input_global_trp", "input_wAcCA79n" ], "layoutDefinitions": { "layout_1": { "options": { "height": 960, "width": 1440 }, "structure": [ { "item": "viz_t3jLGiwh", "position": { "h": 400, "w": 1440, "x": 0, "y": 0 }, "type": "block" } ], "type": "grid" }, "layout_AfZAhYi7": { "structure": [], "type": "grid" } }, "options": {}, "tabs": { "items": [ { "label": "Inventory", "layoutId": "layout_1" }, { "label": "Sales", "layoutId": "layout_AfZAhYi7" } ] } } } ... View more

@ITWhisperer  you're right, the correct source type is  access_combined   ... View more