topic Re: How to populate percentage on bar chart in Dashboards & Visualizations

How to populate percentage on bar chart

Akmal57 — Mon, 08 Apr 2024 03:14:49 GMT

Hi all,

I'm monitoring compliance data for the past 7 days using timechart. My current query displays the count of "comply" and "not comply" events for each day.

index= indexA | timechart span=1d count by audit

However, I'd like to visualize this data as percentages instead. Is it possible to modify the search to display the percentage of compliant and non-compliant events on top of each bar?

Thanks in advance for your help!

Re: How to populate percentage on bar chart

KendallW — Mon, 08 Apr 2024 04:33:42 GMT

Hi @Akmal57, try changing the format of the visualization to stacked

Re: How to populate percentage on bar chart

bowesmana — Mon, 08 Apr 2024 23:04:12 GMT

If you add the following after your timechart command it will change the values from numbers to percentages

| addtotals fieldname=_Total | foreach * [ eval <<FIELD>>=round(('<<FIELD>>'/_Total*100),2) ]

Note that the _ in front of the total field name prevents it from being displayed, then the foreach command just calculates the percentages.

Re: How to populate percentage on bar chart

Akmal57 — Mon, 15 Apr 2024 03:05:06 GMT

Hi @KendallW,

it's not working, it just staking the value of the bar chart.

Re: How to populate percentage on bar chart

Akmal57 — Mon, 15 Apr 2024 01:37:29 GMT

Hi @bowesmana,

index="index A"

| table _time, Audit

| addtotals fieldname=Total

| foreach * [eval Audit=round (('Audit'/Total*100),2)]

above is my query that i have created based on your idea, but seems not working. Below screenshot is the result for above query.

the values not showing in percentage.

Re: How to populate percentage on bar chart

bowesmana — Mon, 15 Apr 2024 22:38:29 GMT

You have not done what I suggested, you have changed the SPL to something that will not work.

Please use the exact code I provided after your timechart command