topic Re: How to show count & percentage of the total count in a chart command? in Splunk Search

How to show count & percentage of the total count in a chart command?

djoobbani — Tue, 16 Aug 2022 13:05:44 GMT

Dear splunk community:

So i am using the following chart command:

<base search> | chart count by url_path, http_status_code | addtotals col=true

to get the following search result: URL (Y-Axis) & http status code (X-Axis)

200 400 500 502 Total

url1 15 5 5 5 30

url2 10 3 6 2 21

25 8 11 7 51

Now i need to add the percentage of each count based on the total number and display the count & percentage together like so:

200 400 500 502 Total

url1 15 (50%) 5 (16%) 5 (16%) 5(16%) 30

url2 10 (47%) 3 (14%) 6 (28%) 2 (9%) 21

25 (49%) 8 (15%) 11 (21%) 7 (13%) 51

Can someone show me how to achieve this? Greatly appreciate your help in advance!

Re: How to show count & percentage of the total count in a chart command

bowesmana — Tue, 16 Aug 2022 04:08:53 GMT

As I suggested in my post to the same question you asked in your other post https://community.splunk.com/t5/Splunk-Search/How-to-get-the-chart-of-count-and-percentage-by-in-one-column/m-p/609547#M211942

you can combine the percentage using the SPL I posted there, which gives you exactly the table you display here, see this.

However, as soon as you turn a count into a non numeric value, it is no longer a numeric value, so Splunk will not chart that as a vertical Y-axis value.

Re: How to show count & percentage of the total count in a chart command?

djoobbani — Tue, 16 Aug 2022 15:14:04 GMT

Thank you very much for the explanation bowesmana.

So i took your SPL (above) and tried running it in my environment, but unfortunately the result is blank and that may be related to the comment u made regarding count turning into a non numeric value. So does this mean there is no solution for this in splunk? Again thanks for your reply!

Re: How to show count & percentage of the total count in a chart command?

bowesmana — Wed, 17 Aug 2022 01:19:50 GMT

Blank results might mean you have no permission to view _internal index...

However, I am not aware of any way to append some text to a number and for Splunk to then plot that numerically. One thought it that if you add data values ON to the chart, whether with some Javascript and CSS you could dynamically change the visible text to add the percentage, but I don't know how to do that.

See this developer tools view of the <tspan> element showing the data label of the graph value. I suspect this IS possible, but you would need to have the CSS and probably Javascript knowledge to do it.