topic Re: Including event count in legend of timechart in Dashboards & Visualizations

Including event count in legend of timechart

splunk_svc — Mon, 17 Oct 2016 00:57:57 GMT

Hi Splunkers.
I'm trying to get event counts for timechart values displayed in the legend.
i.e. In the legend I want to display the event count, in addition to each value.

I am trying to include the count due to a couple of values on the timechart hiding others, having a much higher record count in comparison the the rest.

I am already doing something similar for a pie chart:

[query] | stats count by my_fieldname | eval my_fieldname=my_fieldname.", ".count

(...with the eval command appending the count to the value displayed in the legend)

I don't seem to be able to get this working for a timechart. If I do the following, I end up with only one value appearing in the legend as "NULL"

[query]  |  eval my_fieldname=my_fieldname.", ".count | timechart count by responsestatus

I'm pretty sure this has to be manipulated before the timechart as there don't seem to be any timechart options to include the record count.

Re: Including event count in legend of timechart

alemarzu — Mon, 17 Oct 2016 01:48:55 GMT

Hi @splunk_svc

Is it this what you are looking for ? This is a working example.

index=_internal | eventstats count by sourcetype | eval my_fieldname=sourcetype.", ".count | timechart count by my_fieldname

Hope it helps.

Edit: query outcome

Re: Including event count in legend of timechart

splunk_svc — Tue, 29 Sep 2020 11:26:17 GMT

Thanks alemarzu.

I gave that a go.
I get a single entry in the legend of "VALUE_json" with a total of all events found.
(There should be three values in the legend)

I tried it again and replaced "eval my_fieldname=sourcetype" with "eval my_fieldname=my_fieldname".

I now get the three values listed in the legend but beside each is a the same event count. i.e. the total event count across all three values.

Re: Including event count in legend of timechart

alemarzu — Mon, 17 Oct 2016 13:27:01 GMT

Can you show me how did you adapt the query I've posted or some data samples ?

Re: Including event count in legend of timechart

cmerriman — Mon, 17 Oct 2016 15:07:35 GMT

are you doing:

index=_internal | eventstats count by my_fieldname| eval my_fieldname=sourcetype.", ".count | timechart count by my_fieldname

Re: Including event count in legend of timechart

splunk_svc — Mon, 17 Oct 2016 22:49:14 GMT

Got it.
Using "sourcetype" in the query was converting the value label into "_json".

Replacing sourcetype in alemarzu's query above with my_fieldname did the trick.

Thanks folks.

Re: Including event count in legend of timechart

alemarzu — Tue, 18 Oct 2016 00:17:05 GMT

Nice, im glad it helped. Happy splunking!