Dashboards & Visualizations

How to calculate the percentage in piechart with the field count?

New Member

My index is as below:
index | stats count by c4rupgrd-sourceVersion c4rupgrd-targetVersion

alt text

I want the percentage is calculated by count in pie chart.

Tags (1)
0 Karma
1 Solution

SplunkTrust
SplunkTrust

@jerrytao

Your search producing 3 columns & in Pie Chart If the search generates a table with more than two columns, the extra columns are ignored.. Check https://docs.splunk.com/Documentation/SplunkCloud/7.2.6/Viz/PieChart#Data_formatting

If you observed in your existing pie chart count field is totally ignored which is important for you.

If it's important to display both 'c4rupgrd-sourceVersion&c4rupgrd-targetVersion` values in Pie chart then I suggest combining the value of both the fields and use it. Please check below SPL for same

YOUR_SEARCH | eval c4rupgrd-sourceVersion_c4rupgrd-targetVersion = tostring('c4rupgrd-sourceVersion')."-".tostring('c4rupgrd-targetVersion') | table c4rupgrd-sourceVersion_c4rupgrd-targetVersion count

My Sample search:

| makeresults | eval c4rupgrd-sourceVersion=2018,c4rupgrd-targetVersion=2019,count=11 | append [ | makeresults | eval c4rupgrd-sourceVersion=2018,c4rupgrd-targetVersion=2020,count=1] | append [ | makeresults | eval c4rupgrd-sourceVersion=2010,c4rupgrd-targetVersion=2020,count=3] | eval c4rupgrd-sourceVersion_c4rupgrd-targetVersion = tostring('c4rupgrd-sourceVersion')."-".tostring('c4rupgrd-targetVersion') | table c4rupgrd-sourceVersion_c4rupgrd-targetVersion count

Thanks

View solution in original post

0 Karma

SplunkTrust
SplunkTrust

@jerrytao

Your search producing 3 columns & in Pie Chart If the search generates a table with more than two columns, the extra columns are ignored.. Check https://docs.splunk.com/Documentation/SplunkCloud/7.2.6/Viz/PieChart#Data_formatting

If you observed in your existing pie chart count field is totally ignored which is important for you.

If it's important to display both 'c4rupgrd-sourceVersion&c4rupgrd-targetVersion` values in Pie chart then I suggest combining the value of both the fields and use it. Please check below SPL for same

YOUR_SEARCH | eval c4rupgrd-sourceVersion_c4rupgrd-targetVersion = tostring('c4rupgrd-sourceVersion')."-".tostring('c4rupgrd-targetVersion') | table c4rupgrd-sourceVersion_c4rupgrd-targetVersion count

My Sample search:

| makeresults | eval c4rupgrd-sourceVersion=2018,c4rupgrd-targetVersion=2019,count=11 | append [ | makeresults | eval c4rupgrd-sourceVersion=2018,c4rupgrd-targetVersion=2020,count=1] | append [ | makeresults | eval c4rupgrd-sourceVersion=2010,c4rupgrd-targetVersion=2020,count=3] | eval c4rupgrd-sourceVersion_c4rupgrd-targetVersion = tostring('c4rupgrd-sourceVersion')."-".tostring('c4rupgrd-targetVersion') | table c4rupgrd-sourceVersion_c4rupgrd-targetVersion count

Thanks

View solution in original post

0 Karma

New Member

@kamlesh_vaghela , it works as expected. I really appreciate your help!

0 Karma

SplunkTrust
SplunkTrust

Glad to help you @jerrytao

Happy Splunking

0 Karma