Dashboards & Visualizations

How do I make a chart overlay that calculates the percentage of a specific row's count vs total, in that time period?

thisissplunk
Builder

I'm counting up the hits to my website's specific URI's over each day. I'm using chart because I have to bucket by _time for other reasons related to how the data is dumped from a db into splunk:

 

 

| bucket span=1d _time
| chart count(uri) as uris by  _time domain

 

 

 

This works fine. But what I'd like to do now is be able to dynamically choose one of the URI's as a chart overlay and show its total percentage of the hits vs the total for the day.

I can't figure out how to do this. Is there a way to access the | addtotals "Total" field but for only one column/URI? Or what about using tokens in the search and rerunning the search as I pick different URI's to overlay? Or....?

I got the idea from this: https://docs.splunk.com/Documentation/SplunkCloud/8.2.2107/SearchTutorial/Chartoverlays but I need to figure out how to calculate the percentages dynamically and against | addtotals "Total"

Labels (3)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

You could do something like this with $token$ holding the URI you want as the overlay (percent)

| addtotals fieldname=_Total
| foreach *
    [| eval percent=if("<<FIELD>>"="$token$",100*'<<FIELD>>'/_Total,percent)]

You could also use the token in the name of the field (series) but you would also need to include it in the overlay configuration

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust

You could do something like this with $token$ holding the URI you want as the overlay (percent)

| addtotals fieldname=_Total
| foreach *
    [| eval percent=if("<<FIELD>>"="$token$",100*'<<FIELD>>'/_Total,percent)]

You could also use the token in the name of the field (series) but you would also need to include it in the overlay configuration

thisissplunk
Builder

Thank you! I will try this shortly.

Any idea how I do the same idea but just on the domain values instead?

0 Karma