Dashboards & Visualizations

How to chart percentages data?

xvxt006
Contributor

Hi,
i am using top query and hence i am getting count and percentages in a tabular format. i took out the count field using the - field option but when i try to chart, it shows nothing in the cart. Basically screen is empty. What is the best way to get a chart based on percentages. Below is the query..

.... | top limit=5000 xxxx | fields - count

So the results is like this. Also in the chart if i don't want to have data4. Can i do that? Any help is appreciated.

xxxx percent
data1 10
data2 30
data3 40
data4 20

Tags (1)
0 Karma

xvxt006
Contributor

Thanks Bob. Actually i did that last night and it worked. Thanks for your answer.
Another question, not related to this - i have a query where i am getting dc of sessionIDs and did a sort in descending order for the to 10. Some times i see only 9 but not 10 sometimes it is 8 and when i increase sort for top 11 then it is adding one more. Do you know what could be the reason for this?

0 Karma

xvxt006
Contributor

i think when i used chart command, i am able to get the chart. Below is the query. If i want to exclude one data point can i do that? not the field but one of the data point.

| top limit=5000 xxxx | fields - count | chart avg(percent) as Percentage by xxxx

0 Karma

BobM
Builder

Just add | where xxxx!="data4"

0 Karma
Get Updates on the Splunk Community!

Automatic Discovery Part 1: What is Automatic Discovery in Splunk Observability Cloud ...

If you’ve ever deployed a new database cluster, spun up a caching layer, or added a load balancer, you know it ...

Real-Time Fraud Detection: How Splunk Dashboards Protect Financial Institutions

Financial fraud isn't slowing down. If anything, it's getting more sophisticated. Account takeovers, credit ...

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...