Dashboards & Visualizations

Pie-chart - Display TOTAL in title of the pie-chart but hide/block from displaying in pie-chart

Engager
index=$index$ sourcetype=$sourcetype$ $string1$
.
.
| fillnull value=FALSE
| stats 
count(email) AS TOTAL 
count(eval(authenticated="TRUE")) AS auth_count 
count(eval(cancelled="TRUE")) AS cancelled_count  
count(eval(promoted="TRUE")) AS PROVISIONED 
| eval AUTH_DROP_OUT=TOTAL-auth_count
| eval USER_CANCELLED=auth_count-cancelled_count
| eval LOGIN_DROP_OUT=TOTAL-AUTH_DROP_OUT-USER_CANCELLED-PROVISIONED
| table TOTAL,AUTH_DROP_OUT,LOGIN_DROP_OUT,USER_CANCELLED,PROVISIONED
| transpose
| rename column AS ActionTaken "row "1 AS Count
| eval ActionTaken=ActionTaken." : ".Count
0 Karma

SplunkTrust
SplunkTrust

@hmbisht

For total in Pie Chart Label, can you please try this?

<dashboard>
  <label>Test Dashboard</label>
  <search base="mysearch">
    <query>stats sum(count) as total</query>
    <done>
      <set token="total">$result.total$</set>
    </done>
  </search>
  <row>
    <panel>
      <title>My Pie Chart $total$</title>
      <table>
        <search id="mysearch">
          <query>index="_internal" 
| stats count by log_level</query>
          <earliest>-15m</earliest>
          <latest>now</latest>
        </search>
        <option name="count">20</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">none</option>
        <option name="percentagesRow">false</option>
        <option name="refresh.display">progressbar</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
      </table>
    </panel>
  </row>
</dashboard>
0 Karma