topic Re: Splunk Dashboard to show the values in slices or any way in Dashboards & Visualizations

Splunk Dashboard to show the values in slices or any way

phanikumarcs — Thu, 08 Feb 2024 15:07:17 GMT

Hi Team,

I am trying to create a dashboard pie chart visualization with the spl query.
we have total_apps are 300, how many apps(count) are there out of this.
Note: why i am using "dc" here we have foo_foo_1, foo_foo_2, foo_foo_3 apps.

from this in pie chart its showing only total_apps or currentapps not both in single pie chart
so what is the issue.

Re: Splunk Dashboard to show the values in slices or any way

ITWhisperer — Thu, 08 Feb 2024 13:47:05 GMT

It is not clear what result you are expecting - please can you expand your question

Re: Splunk Dashboard to show the values in slices or any way

phanikumarcs — Thu, 08 Feb 2024 14:32:56 GMT

@ITWhisperer thanks for the response,

actually, I am creating a pie chart in dashboard that will show "totalapps" count and "appname" count on pie chart in two slices.

where our totalapps is 300, and i am extracting appnames using rex.

Re: Splunk Dashboard to show the values in slices or any way

ITWhisperer — Thu, 08 Feb 2024 16:28:45 GMT

Try something like this

Re: Splunk Dashboard to show the values in slices or any way

phanikumarcs — Thu, 08 Feb 2024 19:41:19 GMT

Thanks @ITWhisperer its working for me

Re: Splunk Dashboard to show the values in slices or any way

phanikumarcs — Fri, 09 Feb 2024 10:17:06 GMT

@ITWhisperer it works buts its not showing values(digits) on pie chart

Re: Splunk Dashboard to show the values in slices or any way

ITWhisperer — Fri, 09 Feb 2024 10:33:47 GMT

Numbers show up when you hover over each segment

Re: Splunk Dashboard to show the values in slices or any way

phanikumarcs — Fri, 09 Feb 2024 11:36:34 GMT

So where i can change the changes in the spl or xml source @

Re: Splunk Dashboard to show the values in slices or any way

ITWhisperer — Fri, 09 Feb 2024 11:40:47 GMT

What changes are you expecting - this is the way pie charts work - you could consider appending the value to the title

Re: Splunk Dashboard to show the values in slices or any way

phanikumarcs — Fri, 09 Feb 2024 12:22:01 GMT

@ITWhisperer i am expexting the same in the attached picture

Re: Splunk Dashboard to show the values in slices or any way

ITWhisperer — Fri, 09 Feb 2024 12:51:10 GMT

As you can see here, there are no configuration options for this feature

Re: Splunk Dashboard to show the values in slices or any way

phanikumarcs — Fri, 09 Feb 2024 13:02:22 GMT

1) yes, this is the first approach i have take, later i posted in the community. But why its not showing the value count over chart.

2) by the way @ITWhisperer if you have any idea please help me for this
https://community.splunk.com/t5/All-Apps-and-Add-ons/JSON-data-unexpected-value-count/m-p/677019#M80209

3)is it possible to remove the label name below colored where like "Mon Jan 15" to "Jan 15" like this. from UI or XML source or SPL

Re: Splunk Dashboard to show the values in slices or any way

ITWhisperer — Fri, 09 Feb 2024 13:29:10 GMT

1) already answered - standard pie charts don't have this feature in Splunk

2) responded in thread

3) edit your dashboard panel and change the x-axis title to none

Re: Splunk Dashboard to show the values in slices or any way

phanikumarcs — Fri, 09 Feb 2024 17:35:58 GMT

@ITWhisperer for this 3) edit your dashboard panel and change the x-axis title to none

I have found the solution to this issue. I applied the following SPL code to the existing SPL, and the visualization updated automatically to reflect the changes.

|timechart span=1d count
|eval Date=strftime(_time, "%m/%d")
|table Date, count

@ITWhisperer thanks for your time...