Dashboards & Visualizations

How to show both values and percentages bar chart?

maayan
Path Finder

Hi,

Too many hours to solve such a simple question...It is supposed to be a basic thing

I want to present both percentages and regular values in bar chart (it can be in the tooltip, like it exists in a pie chart),
If not possible to present only percentages but add the "%" symbol (when I tried to add % it converted the fields to string and nothing was shown in the chart)

* I can't add a js script, no access to the server

This is my query:
| stats sum(CountEvents) by CT
| rename "sum(CountEvents)" as "countE"
| eventstats sum(countE) as Total
| eval perc=round(countE*100/Total,2)
| chart sum(perc) as "EventsPercentages[%]" over CT

thanks a lot

Labels (1)
Tags (1)
0 Karma
1 Solution

isoutamo
SplunkTrust
SplunkTrust

Hi

I'm not sure if I understand your need, but maybe this helps?

| stats sum(CountEvents) as countE by CT
| eventstats sum(countE) as Total
| eval perc=round(countE*100/Total,2)
| chart sum(perc) as "EventsPercentages[%]" values(countE) as countE over CT

Then in visualisation tab select Format -> Chart Overlay

- > Overlay (e.g.  your % field) and View as Axis = On

r. Ismo

View solution in original post

0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi

I'm not sure if I understand your need, but maybe this helps?

| stats sum(CountEvents) as countE by CT
| eventstats sum(countE) as Total
| eval perc=round(countE*100/Total,2)
| chart sum(perc) as "EventsPercentages[%]" values(countE) as countE over CT

Then in visualisation tab select Format -> Chart Overlay

- > Overlay (e.g.  your % field) and View as Axis = On

r. Ismo

0 Karma

maayan
Path Finder

Can we show them in one row? for example: 
223,229 (45%)

it will look much better

0 Karma

isoutamo
SplunkTrust
SplunkTrust
You could try eval foo = bar . “(“ . zaa . “%)” or something similar. Then fields - <other unneeded fields>
0 Karma

maayan
Path Finder

Thanks but how to present that in a bar chart? (to add foo to my bar chart). I can present that only in a table

| stats sum(CountEvents) by CT
| rename "sum(CountEvents)" as "countE"
| eventstats sum(countE) as Total
| eval perc=round(countE*100/Total,2)
| eval foo = countE . "(" . perc ."%" .")"
| fields - Total perc

0 Karma

maayan
Path Finder

i added:
| xyseries CT,foo,countE
 to my query i think its ok 🙂

0 Karma

isoutamo
SplunkTrust
SplunkTrust
If needed you could add "|fillnull value=0" at the end.
0 Karma

maayan
Path Finder

Hi thanks
not soo petty, but good enough as a workaround
Do you know how can I add "%" to each value?

current query:
| stats sum(CountEvents) by CT
| rename "sum(CountEvents)" as "CountEvents"
| eventstats sum(CountEvents) as Total
| eval percentages%=round(CountEvents*100/Total,2)
| fields - Total

0 Karma
Get Updates on the Splunk Community!

Developer Spotlight with Paul Stout

Welcome to our very first developer spotlight release series where we'll feature some awesome Splunk ...

State of Splunk Careers 2024: Maximizing Career Outcomes and the Continued Value of ...

For the past four years, Splunk has partnered with Enterprise Strategy Group to conduct a survey that gauges ...

Data-Driven Success: Splunk & Financial Services

Splunk streamlines the process of extracting insights from large volumes of data. In this fast-paced world, ...