I'm trying to display allowed vs blocked traffic for several different accounts. I think a trellis chart with a pie representing each account is a good way to display this. However, I want the dashboard to also convey the total volume of traffic for each account.
Here is my search (altered for simplicity / privacy):
index=(index) (more filters)
|(miscellaneous lookups and filters)
| chart count(_raw) over account by action
| addtotals allowed blocked
This gives me a table that looks like this:
![alt text][1]
That table then gives me a trellis pie chart dash that looks like this:
![alt text][2]
What I would like is for the numbers from the "totals" column in the table to populate with each of the corresponding pies as a label or something.
[1]: /storage/temp/274180-splunktable.png
[2]: /storage/temp/274181-splunktrellis.png
↧