Dashboards & Visualizations

Splunk Dashboard to show the values in slices or any way

phanikumarcs
Explorer

Hi Team,

I am trying to create a dashboard pie chart visualization with the spl query.
we have total_apps are 300, how many apps(count) are there out of this.
Note: why i am using "dc" here we have foo_foo_1, foo_foo_2, foo_foo_3 apps.

|rest /services/data/indexes
|rename title as index
|rex field=index "^foo_(?<appname>.+)"
|rex field=index "^foo_(?<appname>.+)_"
|table appname, index
|stats dc(appname) as currentapps
|eval currentapps = currentapps
|eval total_apps = 300



from this in pie chart its showing only total_apps or currentapps not both in single pie chart
so what is the issue. 

Labels (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Try something like this

|rest /services/data/indexes
|rename title as index
|rex field=index "^foo_(?<appname>.+)"
|rex field=index "^foo_(?<appname>.+)_"
|table appname, index
|stats dc(appname) as count
|eval title = "currentapps"
| append
[| makeresults
| eval count = 300
| eval title="total_apps"]
| table title count

View solution in original post

0 Karma

phanikumarcs
Explorer

Thanks @ITWhisperer  its working for me

0 Karma

phanikumarcs
Explorer

@ITWhisperer  thanks for the response,

actually, I am creating a pie chart in dashboard that will show "totalapps" count and "appname" count on pie chart in two slices.

where our totalapps is 300, and i am extracting appnames using rex.

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Try something like this

|rest /services/data/indexes
|rename title as index
|rex field=index "^foo_(?<appname>.+)"
|rex field=index "^foo_(?<appname>.+)_"
|table appname, index
|stats dc(appname) as count
|eval title = "currentapps"
| append
[| makeresults
| eval count = 300
| eval title="total_apps"]
| table title count
0 Karma

phanikumarcs
Explorer

@ITWhisperer  it works buts its not showing values(digits) on pie chart

phanikumarcs_0-1707473819507.png

 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Numbers show up when you hover over each segment

0 Karma

phanikumarcs
Explorer

So where i can change the changes in the spl or xml source @

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

What changes are you expecting - this is the way pie charts work - you could consider appending the value to the title

|rest /services/data/indexes
|rename title as index
|rex field=index "^foo_(?<appname>.+)"
|rex field=index "^foo_(?<appname>.+)_"
|table appname, index
|stats dc(appname) as count
|eval title = "currentapps: ".count
| append
[| makeresults
| eval count = 300
| eval title="total_apps: ".count]
| table title count

 

0 Karma

phanikumarcs
Explorer

@ITWhisperer  i am expexting the same in the attached picture 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

As you can see here, there are no configuration options for this feature

0 Karma

phanikumarcs
Explorer

1) yes, this is the first approach i have take, later i posted in the community. But why its not showing the value count over chart.

2) by the way @ITWhisperer  if you have any idea please help me for this
https://community.splunk.com/t5/All-Apps-and-Add-ons/JSON-data-unexpected-value-count/m-p/677019#M80...

3)is it possible to remove the label name below colored where like "Mon Jan 15" to "Jan 15" like this. from UI or XML source or SPL

phanikumarcs_0-1707483673191.png

 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

1) already answered - standard pie charts don't have this feature in Splunk

2) responded in thread

3) edit your dashboard panel and change the x-axis title to none

ITWhisperer_0-1707485340047.png

 

0 Karma

phanikumarcs
Explorer

@ITWhisperer for this 3) edit your dashboard panel and change the x-axis title to none

I have found the solution to this issue. I applied the following SPL code to the existing SPL, and the visualization updated automatically to reflect the changes.

|timechart span=1d count
|eval Date=strftime(_time, "%m/%d")
|table Date, count

 

@ITWhisperer thanks for your time...

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

It is not clear what result you are expecting - please can you expand your question

0 Karma
Get Updates on the Splunk Community!

New Dates, New City: Save the Date for .conf25!

Wake up, babe! New .conf25 dates AND location just dropped!! That's right, this year, .conf25 is taking place ...

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud  In today’s fast-paced digital ...

Observability protocols to know about

Observability protocols define the specifications or formats for collecting, encoding, transporting, and ...