Dashboards & Visualizations

Including event count in chart results for Simple XML dashboard

splunk_svc
Path Finder

I'm trying to get a pie chart to display percentages of total results as well as the number of events for each eventtype reported.
(i.e. have the percentage and the event count for each segment of the pie chart displayed.

I can get the percentage displayed using this:

<option name="charting.chart.showPercent">true</option>

I don't see an equivalent option for displaying the event count however.

The only answer I could find was from a couple of years ago
(https://answers.splunk.com/answers/203082/pie-chart-legend-show-as-a-separate-element.html)
(Not exactly what I was looking for but would be a starting point)

It suggests running a second copy of the query and outputting the event count to another table in the same panel:
(sample query)

<panel>
  <chart>
    <searchString>sourcetype=access_* status=200 action=purchase | top categoryId</searchString>
    <earliestTime>0</earliestTime>
    <latestTime/>
    <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
    <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
    <option name="charting.axisTitleX.visibility">visible</option>
    <option name="charting.axisTitleY.visibility">visible</option>
    <option name="charting.axisTitleY2.visibility">visible</option>
    <option name="charting.axisX.scale">linear</option>
    <option name="charting.axisY.scale">linear</option>
    <option name="charting.axisY2.enabled">false</option>
    <option name="charting.axisY2.scale">inherit</option>
    <option name="charting.chart">pie</option>
    <option name="charting.chart.nullValueMode">gaps</option>
    <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
    <option name="charting.chart.stackMode">default</option>
    <option name="charting.chart.style">shiny</option>
    <option name="charting.drilldown">all</option>
    <option name="charting.layout.splitSeries">0</option>
    <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
    <option name="charting.legend.placement">right</option>
  </chart>
  <table>
    <searchString>sourcetype=access_* status=200 action=purchase | top categoryId</searchString>
  </table>
</panel>

The issue with this is that it doubles the length of time it takes to generate the panel.
The query itself can take up to 20 seconds or so, which means waiting 40 seconds for the sake of getting the event count.

Is there a charting option similar to charting.chart.showPercent which can do this to avoid running the second query?

Tags (1)
0 Karma
1 Solution

somesoni2
Revered Legend

Try this workaround (just the query update needed)

sourcetype=access_* status=200 action=purchase | top categoryId | eval categoryId=categoryId." ,".count

View solution in original post

0 Karma

somesoni2
Revered Legend

Try this workaround (just the query update needed)

sourcetype=access_* status=200 action=purchase | top categoryId | eval categoryId=categoryId." ,".count
0 Karma

splunk_svc
Path Finder

Thanks somesoni2. Worked like a treat.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...