Dashboards & Visualizations

Pie-chart - Display TOTAL in title of the pie-chart but hide/block from displaying in pie-chart

hmbisht
Explorer
index=$index$ sourcetype=$sourcetype$ $string1$
.
.
| fillnull value=FALSE
| stats 
count(email) AS TOTAL 
count(eval(authenticated="TRUE")) AS auth_count 
count(eval(cancelled="TRUE")) AS cancelled_count  
count(eval(promoted="TRUE")) AS PROVISIONED 
| eval AUTH_DROP_OUT=TOTAL-auth_count
| eval USER_CANCELLED=auth_count-cancelled_count
| eval LOGIN_DROP_OUT=TOTAL-AUTH_DROP_OUT-USER_CANCELLED-PROVISIONED
| table TOTAL,AUTH_DROP_OUT,LOGIN_DROP_OUT,USER_CANCELLED,PROVISIONED
| transpose
| rename column AS ActionTaken "row "1 AS Count
| eval ActionTaken=ActionTaken." : ".Count
0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@hmbisht

For total in Pie Chart Label, can you please try this?

<dashboard>
  <label>Test Dashboard</label>
  <search base="mysearch">
    <query>stats sum(count) as total</query>
    <done>
      <set token="total">$result.total$</set>
    </done>
  </search>
  <row>
    <panel>
      <title>My Pie Chart $total$</title>
      <table>
        <search id="mysearch">
          <query>index="_internal" 
| stats count by log_level</query>
          <earliest>-15m</earliest>
          <latest>now</latest>
        </search>
        <option name="count">20</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">none</option>
        <option name="percentagesRow">false</option>
        <option name="refresh.display">progressbar</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
      </table>
    </panel>
  </row>
</dashboard>
0 Karma
Get Updates on the Splunk Community!

Accelerating Observability as Code with the Splunk AI Assistant

We’ve seen in previous posts what Observability as Code (OaC) is and how it’s now essential for managing ...

Integrating Splunk Search API and Quarto to Create Reproducible Investigation ...

 Splunk is More Than Just the Web Console For Digital Forensics and Incident Response (DFIR) practitioners, ...

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...