In a pie chart we can show the percentage by setting charting.chart.showPercent to true. But how do I display the actual data not the percentage?
You can cheat by changing your split-by values to contain the actual data: ... | stats count by foo | eval foo = foo . " (" . count . ")"
... | stats count by foo | eval foo = foo . " (" . count . ")"
Keep in mind that this will mess with drilldowns!
Do post your search string.
It is working but now instead of field values it is showing the field name. Like if I had field values yes & no under the field foobar,it is showing foobar(5) & foobar(2) instead of yes(5) & no(2). Anything can be dne about this?
