topic Re: Show percent instead of count in top chart in Splunk Search

Show percent instead of count in top chart

ctoo — Wed, 18 Jul 2012 22:03:19 GMT

I'm using the top command and wanted the generated chart to show the percent value for each of the items instead of the count. The documentation doesn't say how to do this and I couldn't find an answer by searching this forum, but I eventually figured out a way to do it which I'll post here as an answer in case others have the same need.

Re: Show percent instead of count in top chart

ctoo — Wed, 18 Jul 2012 22:06:21 GMT

Here's how to do it:

... | top showcount=false percentfield=count ...

This works because the chart is hardcoded to display the "count" value.

Re: Show percent instead of count in top chart

lguinn2 — Wed, 18 Jul 2012 22:23:00 GMT

or just

... | top showcount=false fieldForTop

To show only the percent field. To show only the count field:

... | top showperc=false fieldForTop

Or you can always pipe to the fields command

... | top  fieldForTop | fields - count

... | top  fieldForTop | fields - percent

Re: Show percent instead of count in top chart

ctoo — Thu, 19 Jul 2012 02:06:42 GMT

At least w/ Splunk 4.3.1, which we're using, doing the above doesn't work -- it shows an empty chart.

To be clear, I'm talking specifically about the Results Chart view of the top output, not the Table view for which your solution works.

Re: Show percent instead of count in top chart

Ayn — Thu, 19 Jul 2012 06:21:20 GMT

Use table to reorder the results. The graph results view seems to simply grab the first two fields in the generated table and then use the first field as its X axis and the second field for Y axis. So, the following will do the trick:

... | top field | table field percent

Re: Show percent instead of count in top chart

ctoo — Thu, 19 Jul 2012 23:54:05 GMT

Thanks, that works too.