topic Re: how to create a chart with percentage ? in Dashboards & Visualizations

how to create a chart with percentage ?

gowthamkb — Tue, 29 Sep 2020 11:10:20 GMT

Location Processing Time (minutes) trans_date

Central 21 09/21/2016
South East 40 09/22/2016

Is there a way I can get a chart with time buckets , y-axis-primary showing percentage (transactions), y-axis secondary showing processing_time (0-10 mins, 10-20 mins etc) and x axis showing trans_date ?

Re: how to create a chart with percentage ?

somesoni2 — Tue, 27 Sep 2016 17:01:15 GMT

Could you provide some mock output (table) on what you data would look like?

Re: how to create a chart with percentage ?

gowthamkb — Tue, 27 Sep 2016 17:13:29 GMT

Hi- following is the mock table

Trans_date DurationBucket Percent
9/21/2016 0-10Mins 10.35
9/22/2016 10-20 Mins 25.23

Re: how to create a chart with percentage ?

somesoni2 — Tue, 27 Sep 2016 17:17:35 GMT

And how is the percent calculated? Based on count of events for that day OR total events for all day?

Re: how to create a chart with percentage ?

gowthamkb — Tue, 27 Sep 2016 17:22:08 GMT

based on count of events for that day. Thank you

Re: how to create a chart with percentage ?

somesoni2 — Tue, 27 Sep 2016 17:25:40 GMT

Give this a try.

your current search giving field Location, Processing_time, trans_date
| bucket span=10 Processing_time 
| stats count by trans_date Processing_time 
| eventstats sum(count) as Total by trans_date
| eval Percent=round(count*100/Total,2)
| table trans_date, Processing_time Percent
| rename Processing_time as DurationBucket

Re: how to create a chart with percentage ?

gowthamkb — Tue, 29 Sep 2020 11:10:23 GMT

hi. Thanks for above command. how can I tweak the above command to get total events for all day, so that I can view the percentage of events that are processed on a given day within timebucket (i.e 10% events processed in 0-10 mins, 25% events processed in 10-20 mins on 9/25/2016 (trans_date) and the same on 09/26/2016 (trans_date) etc)

Re: how to create a chart with percentage ?

somesoni2 — Tue, 27 Sep 2016 18:17:51 GMT

Is it not giving you that right now? It is calculating the percentage based on total events.

Re: how to create a chart with percentage ?

gowthamkb — Tue, 27 Sep 2016 18:32:18 GMT

With the above command I am getting individual columns per date . I actually want a chart that shows the following . X-axis should show the date and the column should be divided by events percentage for a given day.

y-Axis (time buckets)

30 % 35%
20 % 26%

10 % 12%

X-Axis 09/25 09/26

Re: how to create a chart with percentage ?

somesoni2 — Tue, 27 Sep 2016 18:36:43 GMT

Give this a try..

your current search giving field Location, Processing_time, trans_date
 | bucket span=10 Processing_time 
 | stats count by trans_date Processing_time 
 | eventstats sum(count) as Total by trans_date
 | eval Percent=round(count*100/Total,2)
 | table trans_date, Processing_time Percent
 | rename Processing_time as DurationBucket | xyseries trans_date DurationBucket Percent

Re: how to create a chart with percentage ?

gowthamkb — Tue, 27 Sep 2016 19:09:48 GMT

Hi. it is working to an extent. It is giving me multiple columns on the graph per date. I actually want to get a single column on the chart per date and that column should be shown in buckets with event percents. In this case, we will have dual y-axis. left Y-axis will show the percent and the right y-axis will show the average time . Not sure if this can be done in splunk.

Re: how to create a chart with percentage ?

somesoni2 — Tue, 27 Sep 2016 19:20:41 GMT

Can you try my original answer with stacked chart option?

Re: how to create a chart with percentage ?

gowthamkb — Tue, 27 Sep 2016 20:31:19 GMT

Hi. Thanks a lot for guidance. With the stacked chart option I was able to merge the events to a single column per date. In the same chart, Is there a way in splunk to show a line which gives the average time (i.e average time taken by events on a given day) ?

Re: how to create a chart with percentage ?

somesoni2 — Tue, 27 Sep 2016 21:20:49 GMT

Give this a try. Select stacked chart option and in chart overlay select field AverageTime

your current search giving field Location, Processing_time, trans_date
| eventstats avg(Processing_time) as avg by trans_date
 | bucket span=10 Processing_time 
 | stats count values(avg) as avg by trans_date Processing_time 
 | eventstats sum(count) as Total by trans_date
 | eval Percent=round(count*100/Total,2)
 | table trans_date, Processing_time Percent avg
 | rename Processing_time as DurationBucket avg as AverageTime

Re: how to create a chart with percentage ?

gowthamkb — Tue, 27 Sep 2016 21:39:04 GMT

Hi. With the above command I was able to get the average time with the overlay option but the columns are not stacked (even after selecting the stacked chart option). On a given date (trans_date) it is showing column for each DurationBucket.

Re: how to create a chart with percentage ?

somesoni2 — Wed, 28 Sep 2016 01:49:35 GMT

See if solution for this post works for you.

https://answers.splunk.com/answers/81701/chart-overlay-and-different-graph-type.html

Re: how to create a chart with percentage ?

gowthamkb — Tue, 29 Sep 2020 11:10:57 GMT

Thank you !! The following command you gave what I wanted.

your current search giving field Location, Processing_time, trans_date
| bucket span=10 Processing_time
| stats count by trans_date Processing_time
| eventstats sum(count) as Total by trans_date
| eval Percent=round(count*100/Total,2)
| table trans_date, Processing_time Percent
| rename Processing_time as DurationBucket | xyseries trans_date DurationBucket Percent