Hi,
I have a pie graph which shows slices based on the count in each category. On splunk interface, I can see the actual count on each slice using tooltip. But when I export to a pdf, tooltip option will not be available, so counts are not visible.
Is there any way to display count on pie chart slices as labels? I have tried a few suggestions seen in the forum like using layout sprite etc, but none of them worked.
Please let me know whether it is possible at all to do this in splunk, and if so how to do it.
Thanks
You can alter the given label after the chart has been rendered. For example, if you had a search that produces a simple count using top:
* earliest=-15m | top sourcetype
That may produce a pie chart like this one:
Understand that your label is derived from column 1 or the "sourcetype" field. After the table has been generated, modify column 1 to include the count.
| eval sourcetype=sourcetype." count:".count
That will render something like this:
All together your search would look like this:
* earliest=-15m | top sourcetype | eval sourcetype=sourcetype." count:".count
gc
You can alter the given label after the chart has been rendered. For example, if you had a search that produces a simple count using top:
* earliest=-15m | top sourcetype
That may produce a pie chart like this one:
Understand that your label is derived from column 1 or the "sourcetype" field. After the table has been generated, modify column 1 to include the count.
| eval sourcetype=sourcetype." count:".count
That will render something like this:
All together your search would look like this:
* earliest=-15m | top sourcetype | eval sourcetype=sourcetype." count:".count
gc
your suggestion worked perfectly well. Thanks a ton.
I'm not sure if that's possible with the built-in pie graph but this sweet app might be what you're looking for: http://splunk-base.splunk.com/apps/56187/donut-charts