<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Re: How to chart percentages data? in Dashboards &amp; Visualizations</title>
    <link>https://community.splunk.com/t5/Dashboards-Visualizations/How-to-chart-percentages-data/m-p/95533#M44206</link>
    <description>&lt;P&gt;i think when i used chart command, i am able to get the chart. Below is the query.  If i want to exclude one data point can i do that? not the field but one of the data point.&lt;/P&gt;

&lt;P&gt;| top limit=5000 xxxx | fields - count | chart avg(percent) as Percentage by xxxx&lt;/P&gt;</description>
    <pubDate>Tue, 16 Apr 2013 03:30:59 GMT</pubDate>
    <dc:creator>xvxt006</dc:creator>
    <dc:date>2013-04-16T03:30:59Z</dc:date>
    <item>
      <title>How to chart percentages data?</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/How-to-chart-percentages-data/m-p/95532#M44205</link>
      <description>&lt;P&gt;Hi, &lt;BR /&gt;
i am using top query and hence i am getting count and percentages in a tabular format. i took out the count field using the - field option but when i try to chart, it shows nothing in the cart. Basically screen is empty. What is the best way to get a chart based on percentages. Below is the query..&lt;/P&gt;

&lt;P&gt;.... | top limit=5000 xxxx | fields - count&lt;/P&gt;

&lt;P&gt;So the results is like this. Also in the chart if i don't want to have data4. Can i do that? Any help is appreciated.&lt;/P&gt;

&lt;P&gt;xxxx            percent&lt;BR /&gt;
data1           10&lt;BR /&gt;
data2           30&lt;BR /&gt;
data3           40&lt;BR /&gt;
data4           20&lt;/P&gt;</description>
      <pubDate>Tue, 16 Apr 2013 03:11:46 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/How-to-chart-percentages-data/m-p/95532#M44205</guid>
      <dc:creator>xvxt006</dc:creator>
      <dc:date>2013-04-16T03:11:46Z</dc:date>
    </item>
    <item>
      <title>Re: How to chart percentages data?</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/How-to-chart-percentages-data/m-p/95533#M44206</link>
      <description>&lt;P&gt;i think when i used chart command, i am able to get the chart. Below is the query.  If i want to exclude one data point can i do that? not the field but one of the data point.&lt;/P&gt;

&lt;P&gt;| top limit=5000 xxxx | fields - count | chart avg(percent) as Percentage by xxxx&lt;/P&gt;</description>
      <pubDate>Tue, 16 Apr 2013 03:30:59 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/How-to-chart-percentages-data/m-p/95533#M44206</guid>
      <dc:creator>xvxt006</dc:creator>
      <dc:date>2013-04-16T03:30:59Z</dc:date>
    </item>
    <item>
      <title>Re: How to chart percentages data?</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/How-to-chart-percentages-data/m-p/95534#M44207</link>
      <description>&lt;P&gt;Just add  | where xxxx!="data4"&lt;/P&gt;</description>
      <pubDate>Tue, 16 Apr 2013 11:13:05 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/How-to-chart-percentages-data/m-p/95534#M44207</guid>
      <dc:creator>BobM</dc:creator>
      <dc:date>2013-04-16T11:13:05Z</dc:date>
    </item>
    <item>
      <title>Re: How to chart percentages data?</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/How-to-chart-percentages-data/m-p/95535#M44208</link>
      <description>&lt;P&gt;Thanks Bob. Actually i did that last night and it worked. Thanks for your answer. &lt;BR /&gt;
Another question, not related to this - i have a query where i am getting dc of sessionIDs and did a sort in descending order for the to 10. Some times i see only 9 but not 10 sometimes it is 8 and when i increase sort for top 11 then it is adding one more. Do you know what could be the reason for this?&lt;/P&gt;</description>
      <pubDate>Tue, 16 Apr 2013 13:05:20 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/How-to-chart-percentages-data/m-p/95535#M44208</guid>
      <dc:creator>xvxt006</dc:creator>
      <dc:date>2013-04-16T13:05:20Z</dc:date>
    </item>
  </channel>
</rss>

