In splunk charting, there is a property showDataLabels, its options are: all | minmax | none.
It shows data values on a chart. But I need to show data labels on a chart so as their values are from other data series, no that was used for plotting. For example, here i plot by USD series while show data labels from % series:
Q1 | Q2 | Q3 | |
Shop1, USD | 50 | 100 | 100 |
Shop1, % | 25% | 20% | 10% |
Shop2, USD | 150 | 400 | 900 |
Shop2, % | 75% | 80% | 90% |
I attach a screenshot of result chart.
Now i do it in MS Excel chart (in attached screenshot, it's a setting Label Options - Values From Cells). But want to migrate to splunk. Is it possible in Splunk?
| makeresults
| eval _raw="category,Q1,Q2,Q3
Shop1 USD,50,100,100
Shop1 %,25%,20%,10%
Shop2 USD,150,400,900
Shop2 %,75%,80%,90%"
| multikv forceheader=1
| table category Q1 Q2 Q3
| untable category quater value
| xyseries quater category value
| table quater "Shop1 %" "Shop2 %"
| foreach Shop* [ eval "<<FIELD>>"= substr('<<FIELD>>',-3,2)]
like This?