Displaying count as label in pie graph

[anusuya_k]

Hi,
I have a pie graph which shows slices based on the count in each category. On splunk interface, I can see the actual count on each slice using tooltip. But when I export to a pdf, tooltip option will not be available, so counts are not visible.

Is there any way to display count on pie chart slices as labels? I have tried a few suggestions seen in the forum like using layout sprite etc, but none of them worked.

Please let me know whether it is possible at all to do this in splunk, and if so how to do it.

Thanks

[Gilberto_Castil · Accepted solution]

You can alter the given label after the chart has been rendered. For example, if you had a search that produces a simple count using top:

 * earliest=-15m | top sourcetype

That may produce a pie chart like this one:

Understand that your label is derived from column 1 or the "sourcetype" field. After the table has been generated, modify column 1 to include the count.

 | eval sourcetype=sourcetype." count:".count

That will render something like this:

All together your search would look like this:

* earliest=-15m | top sourcetype | eval sourcetype=sourcetype." count:".count

---

gc

[anusuya_k]

your suggestion worked perfectly well. Thanks a ton.

[clymbouris]

I'm not sure if that's possible with the built-in pie graph but this sweet app might be what you're looking for: http://splunk-base.splunk.com/apps/56187/donut-charts