topic Re: Pie chart round default percentage in Splunk Search

Pie chart round default percentage

tamduong16 — Tue, 29 Sep 2020 16:49:07 GMT

I have the following search:

index="monthlycdr" | eval "transporttype"=replace('Transport Type',"\"","") | eval "tt"=case( match(transporttype, "(?i)voice_sip"), "Sip_voice",match(transporttype, "(?i)sIp"), "Sip", match(transporttype, "(?i)voice_H323"), "H323_voice",match(transporttype, "(?i)H323"), "H323", match(transporttype, "(?i)pstn"), "PSTN") | stats count by tt

with the option:

And this is my result picture:

I know by default splunk has this percentage to 3 decimals. But is there anyway I could round it to 1? If not, how can I calculate it manually in my search base on the search that I have now? I've tried to calculate the percentage from my search but due to the case statement, I can't figure out a way to calculate the percentage value.

Thanks!

Re: Pie chart round default percentage

niketn — Thu, 16 Nov 2017 16:48:43 GMT

@ tamduong16, This has definitely been answered before. You will have to calculate percent in your query and then replace your Pie chart label to have Name as well as rounded off percent. Then you turn of the showPercent option since your Label itself will display the percent (without hover)

https://answers.splunk.com/answers/351010/how-to-round-a-percentage-value-in-a-pie-chart-to.html
Or
https://answers.splunk.com/answers/589417/how-to-round-the-decimal-percentage-in-a-piechart.html

Try the following search (it will have better performance than yours)

 index="monthlycdr"
| stats count as transportcount by "Transport Type"
| eval transporttype=replace('Transport Type',"\"","") 
| fields - "Transport Type"
| eval transporttype=case( match(transporttype, "voice_sip"), "Sip_voice",match(transporttype, "(?i)sIp"), "Sip", match(transporttype, "(?i)voice_H323"), "H323_voice",match(transporttype, "(?i)H323"), "H323", match(transporttype, "(?i)pstn"), "PSTN")
| eventstats sum(transportcount) as Total
| eval perc=round((transportcount/Total)*100,1)
| eval transporttype=transporttype." (".perc."%)"
| table transporttype transportcount

This performs stats first and then massages the aggregated data using eval as per our need. In your case eval runs on entire raw data.

Re: Pie chart round default percentage

sgessati — Tue, 29 Sep 2020 17:59:21 GMT

Although that does the job, since each label will be generated using the percentage attached to it, we can't use the charting.fieldColors option anymore.
Unless there's a way to use wildcards in the field name but I know this doesn't work as it is :
{"UP*":0x97D2B4,"DOWN*":0xf2963f}

Re: Pie chart round default percentage

niketn — Tue, 13 Feb 2018 15:33:22 GMT

@sgessati , you can use CSS Selector to apply color using [^UP] or [^DOWN]. If you can post a separate question with the series names you intend to use, community members would be able to assist with required CSS.

Re: Pie chart round default percentage

sgessati — Tue, 13 Feb 2018 15:47:41 GMT

@niketnilay , thanks. I almost never use CSS but I'll google CSS Selector.
My categories are "UP - {countResults}" and "DOWN - {countResults}". 🙂

Re: Pie chart round default percentage

niketn — Tue, 13 Feb 2018 17:19:45 GMT

On second thought, you can directly rely of charting.seriesColors as far as both DOWN and UP fields are present (i.e. they should show up as 0 instead of not being present in result at all).

Since DOWN comes before UP in alphabetical order, it will pick up the first series color and UP will pick second series color. Try the following instead of charting.fieldColors

    <option name="charting.seriesColors">["#d93f3c","#65a637"]</option>

Since CSS override is for SVG element even that would be depended on CSS override to be applied on series rather than field names (unless you use jQuery which will complicate things).
@sgessati Please try out and confirm.