topic Re: Displaying count as label in pie graph in Dashboards & Visualizations

Displaying count as label in pie graph

anusuya_k — Sat, 15 Jun 2013 11:07:00 GMT

Hi,
I have a pie graph which shows slices based on the count in each category. On splunk interface, I can see the actual count on each slice using tooltip. But when I export to a pdf, tooltip option will not be available, so counts are not visible.

Is there any way to display count on pie chart slices as labels? I have tried a few suggestions seen in the forum like using layout sprite etc, but none of them worked.

Please let me know whether it is possible at all to do this in splunk, and if so how to do it.

Thanks

Re: Displaying count as label in pie graph

clymbouris — Sun, 16 Jun 2013 15:15:59 GMT

I'm not sure if that's possible with the built-in pie graph but this sweet app might be what you're looking for: http://splunk-base.splunk.com/apps/56187/donut-charts

Re: Displaying count as label in pie graph

Gilberto_Castil — Sun, 16 Jun 2013 19:42:52 GMT

You can alter the given label after the chart has been rendered. For example, if you had a search that produces a simple count using top:

 * earliest=-15m | top sourcetype

That may produce a pie chart like this one:

Understand that your label is derived from column 1 or the "sourcetype" field. After the table has been generated, modify column 1 to include the count.

 | eval sourcetype=sourcetype." count:".count

That will render something like this:

All together your search would look like this:

* earliest=-15m | top sourcetype | eval sourcetype=sourcetype." count:".count

Re: Displaying count as label in pie graph

anusuya_k — Thu, 20 Jun 2013 18:04:40 GMT

your suggestion worked perfectly well. Thanks a ton.