topic Calculate percentage of total and display as pie chart in Splunk Search

Calculate percentage of total and display as pie chart

balash1979 — Fri, 25 Dec 2020 18:43:06 GMT

I have total of 7M users. My splunk query shows the count of completed users. I want to draw a pie chart showing completed users vs Total users.

So far I have gotten this far

<< my query>> | eval TotalMax=7000000 | stats count(Path) as completed | eval perc=(completed/TotalMax)/100 | table completed,perc

count(Path) which is same as completed comes out as 200000
But perc is not getting calculated. Am I missing anything ?

--Sunray

Re: Calculate percentage of total and display as pie chart

scelikok — Fri, 25 Dec 2020 19:48:03 GMT

Hi @balash1979,

After stats command only fields that stats outputs are exist. On your case you are loosing TotalMax field, so perc cannot be calculated. Below should work;

<< my query>> | stats count(Path) as completed | eval TotalMax=7000000 | eval perc=(completed/TotalMax)/100 | table completed,perc

<< my query>> | eval TotalMax=7000000 | stats count(Path) as completed values(TotalMax) as TotalMax | eval perc=(completed/TotalMax)/100 | table completed,perc

If this reply helps you an upvote is appreciated.

Re: Calculate percentage of total and display as pie chart

balash1979 — Fri, 25 Dec 2020 20:21:44 GMT

Thanks. If i add "table completed, perc" , i can get the correct data.

How can i display this as a pie chart ? in the pie chart, i would like to see % completed out of the total. Thanks