topic Re: help for formatting a pie chart in Dashboards & Visualizations

help for formatting a pie chart

jip31 — Sat, 04 May 2019 06:22:48 GMT

I use the search below in order to display the data in a pie chart

| inputlookup host.csv 
| lookup PanaBatteryStatus.csv "Hostname00" as host OUTPUT BatteryTemp00 
| where BatteryTemp00 > 30 
| stats count as NbHostBattSup30
| appendcols 
    [| inputlookup host.csv 
    | stats count as NbIndHost] 
| eval NbHostBattInf30 = (NbIndHost - NbHostBattSup30) 
| eval NbHostBattSup30=NbHostBattSup30, NbHostBattInf30=NbHostBattInf30 
| table NbHostBattSup30 NbHostBattInf30
| transpose

I would like to just display one decimal
So I do this but it doesn't works

    | eval NbHostBattSup30=round(NbHostBattSup30, 1), NbHostBattInf30=round(NbHostBattInf30, 1)

I would also have the result in bold and to display the integer value in addition to the percentage
could you help me please??

Re: help for formatting a pie chart

Sukisen1981 — Sat, 04 May 2019 08:55:58 GMT

Try this on your default _audit index.
Copy paste this code and run

index="_audit" 
| stats count by info
| eventstats sum(count) as count1
| eval perc=round(count*100/count1,1)
| eval info=info+"-"+"count:"+count+","+"percentage:"+perc
| fields info,perc

Re: help for formatting a pie chart

woodcock — Sat, 04 May 2019 20:22:58 GMT

Try this:

| inputlookup host.csv 
| lookup PanaBatteryStatus.csv "Hostname00" as host OUTPUT BatteryTemp00 
| where BatteryTemp00 > 30 
| stats count as NbHostBattSup30
| appendcols 
[| inputlookup host.csv 
| stats count as NbIndHost] 
| eval NbHostBattInf30 = (NbIndHost - NbHostBattSup30) 
| eval NbHostBattSup30=NbHostBattSup30, NbHostBattInf30=NbHostBattInf30 
| table NbHostBattSup30 NbHostBattInf30 
| untable foo key value
| fields - foo

Re: help for formatting a pie chart

jip31 — Tue, 07 May 2019 06:11:13 GMT

hi
with this, I have any percentage...

Re: help for formatting a pie chart

jip31 — Tue, 07 May 2019 06:20:55 GMT

I have no right on this index and I try to adapt your code in mine but it doesnt works...

Re: help for formatting a pie chart

Sukisen1981 — Sat, 11 May 2019 08:33:45 GMT

Hi @jip31 - Can you not install the free splunk enterprise on your local and try out the above code?

Re: help for formatting a pie chart

woodcock — Sat, 11 May 2019 19:03:32 GMT

More words.

Re: help for formatting a pie chart

woodcock — Mon, 13 May 2019 19:17:29 GMT

Did you mean to click Answer? It doesn't really make sense to, if you cannot test it.