Dashboards & Visualizations

How to calculate the percentage in piechart with the field count?

jerrytao
New Member

My index is as below:
index | stats count by c4rupgrd-sourceVersion c4rupgrd-targetVersion

alt text

I want the percentage is calculated by count in pie chart.

Tags (1)
0 Karma
1 Solution

kamlesh_vaghela
SplunkTrust
SplunkTrust

@jerrytao

Your search producing 3 columns & in Pie Chart If the search generates a table with more than two columns, the extra columns are ignored.. Check https://docs.splunk.com/Documentation/SplunkCloud/7.2.6/Viz/PieChart#Data_formatting

If you observed in your existing pie chart count field is totally ignored which is important for you.

If it's important to display both 'c4rupgrd-sourceVersion&c4rupgrd-targetVersion` values in Pie chart then I suggest combining the value of both the fields and use it. Please check below SPL for same

YOUR_SEARCH | eval c4rupgrd-sourceVersion_c4rupgrd-targetVersion = tostring('c4rupgrd-sourceVersion')."-".tostring('c4rupgrd-targetVersion') | table c4rupgrd-sourceVersion_c4rupgrd-targetVersion count

My Sample search:

| makeresults | eval c4rupgrd-sourceVersion=2018,c4rupgrd-targetVersion=2019,count=11 | append [ | makeresults | eval c4rupgrd-sourceVersion=2018,c4rupgrd-targetVersion=2020,count=1] | append [ | makeresults | eval c4rupgrd-sourceVersion=2010,c4rupgrd-targetVersion=2020,count=3] | eval c4rupgrd-sourceVersion_c4rupgrd-targetVersion = tostring('c4rupgrd-sourceVersion')."-".tostring('c4rupgrd-targetVersion') | table c4rupgrd-sourceVersion_c4rupgrd-targetVersion count

Thanks

View solution in original post

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@jerrytao

Your search producing 3 columns & in Pie Chart If the search generates a table with more than two columns, the extra columns are ignored.. Check https://docs.splunk.com/Documentation/SplunkCloud/7.2.6/Viz/PieChart#Data_formatting

If you observed in your existing pie chart count field is totally ignored which is important for you.

If it's important to display both 'c4rupgrd-sourceVersion&c4rupgrd-targetVersion` values in Pie chart then I suggest combining the value of both the fields and use it. Please check below SPL for same

YOUR_SEARCH | eval c4rupgrd-sourceVersion_c4rupgrd-targetVersion = tostring('c4rupgrd-sourceVersion')."-".tostring('c4rupgrd-targetVersion') | table c4rupgrd-sourceVersion_c4rupgrd-targetVersion count

My Sample search:

| makeresults | eval c4rupgrd-sourceVersion=2018,c4rupgrd-targetVersion=2019,count=11 | append [ | makeresults | eval c4rupgrd-sourceVersion=2018,c4rupgrd-targetVersion=2020,count=1] | append [ | makeresults | eval c4rupgrd-sourceVersion=2010,c4rupgrd-targetVersion=2020,count=3] | eval c4rupgrd-sourceVersion_c4rupgrd-targetVersion = tostring('c4rupgrd-sourceVersion')."-".tostring('c4rupgrd-targetVersion') | table c4rupgrd-sourceVersion_c4rupgrd-targetVersion count

Thanks

0 Karma

jerrytao
New Member

@kamlesh_vaghela , it works as expected. I really appreciate your help!

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

Glad to help you @jerrytao

Happy Splunking

0 Karma
Get Updates on the Splunk Community!

Ready, Set, SOAR: How Utility Apps Can Up Level Your Playbooks!

 WATCH NOW Powering your capabilities has never been so easy with ready-made Splunk® SOAR Utility Apps. Parse ...

DevSecOps: Why You Should Care and How To Get Started

 WATCH NOW In this Tech Talk we will talk about what people mean by DevSecOps and deep dive into the different ...

Introducing Ingest Actions: Filter, Mask, Route, Repeat

WATCH NOW Ingest Actions (IA) is the best new way to easily filter, mask and route your data in Splunk® ...