Search code examples
splunksplunk-querysplunk-formulasplunk-dashboard

Splunk - Add numeric columns and display only that result


This is my Splunk query:

| stats count by Successful_Unsuccessful 

This is what the result looks like: enter image description here

What I want to do is total all the numeric values in the count column and display it as a Single Value Visualization in a dashboard panel

I tried doing this which sort of works but doesn't fulfill my requirement:

| stats count by Successful_Unsuccessful 
| addcoltotals labelfield=Successful_Unsuccessful label="Grand Totals" count

This does add all the numeric values and gives me the total but I want the Grand Total to be the only value that appears so that I can use it in a Single Value Visualization in a Dashboard Panel

Issue in picture: enter image description here


Solution

  • For a single-value visualization, all you need is the total count.

    | stats count