dashboard component show fraction of two search results as percentage

[mgarland]

I have two data sources or searches that return a number. They are used to supply data to radial components. I've ticked the box so both are also available as tokens, Numerator and Denominator. I'd like a dashboard component that expresses the ratio of those numbers as a percent. How do I do this?

I've tried creating a third search that returns the value, but that does not to work:

| eval result=round("$Denominator$" / "$Numerator$" * 100)."%"

[dtburrows3]

You can try putting a makeresults command at the start of your third search an it may work.
Assuming the the tokens $Denominator$ and $Numerator$ both populate as expected then running this SPL on your dashboard should do it.

| makeresults 
    | eval
        result=round((tonumber("$Numerator$")/tonumber("$Denominator$"))*100)."%"
    | fields - _time

 POC on local instance:

[mgarland]

This query results in the component having the "Set token value to..." error. 

I'm wondering what your data sources look like? Both of mine end with "stats count".  I tried to change the reference to "$Numerator.result$" because that was suggested in a hover-over, however, the query still did not work ("Set token value to...")

[dtburrows3]

Sorry, your initial post made it sound like you already have the tokens $Numerator$ and $Denominator$ ready to go. I'm a bit lost on the error you are describing.

But just going off your initial post, Two searches feeding two radial gauges using a "| stats count" to transforms the searches into a single value in a field named "count". 

I would use a done tag in the XML to set the resulting field "count" value of search1 to a token named "Numerator" and another done tag for search2 to set resulting field "count" value to token "Denominator".

With these two tokens set based on the results of the two searches, they can be used elsewhere on the dashboard, including getting injected into an eval expression directly after a generating command "| makeresults"

Here is an example of this methodology used here.

And a snippet of XML used to do this. Obviously you would need to put your own searches into the radial gauge panels.

<row>
    <panel>
      <chart>
        <title>Search to generate numerator</title>
        <search>
          <query>
| makeresults count=173
``` search1 goes here - replace the makeresults above with your own search ```
    | stats
        count as count
          </query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
          <done>
            <set token="Numerator">$result.count$</set>
          </done>
        </search>
        <option name="charting.chart">radialGauge</option>
        <option name="charting.chart.rangeValues">[0,250,500,1000]</option>
        <option name="charting.chart.style">shiny</option>
        <option name="charting.gaugeColors">["0x118832","0xcba700","0xd41f1f"]</option>
      </chart>
    </panel>
    <panel>
      <chart>
        <title>Search to generate denominator</title>
        <search>
          <query>
| makeresults count=1026
``` search2 goes here - replace the makeresults above with your own search ```
    | stats
        count as count
          </query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
          <done>
            <set token="Denominator">$result.count$</set>
          </done>
        </search>
        <option name="charting.chart">radialGauge</option>
        <option name="charting.chart.rangeValues">[0,250,500,1000]</option>
        <option name="charting.gaugeColors">["0x118832","0xcba700","0xd41f1f"]</option>
      </chart>
    </panel>
  </row>
  <row>
    <panel>
      <title>01/09/2024 - dashboard component show fraction of two search results as percentage</title>
      <single>
        <search>
          <query>| makeresults 
    | eval
        result=round((tonumber("$Numerator$")/tonumber("$Denominator$"))*100)."%"
    | fields - _time</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">none</option>
        <option name="height">181</option>
      </single>
    </panel>
  </row>

 The reason for showing you this is to demonstrate setting tokens based on results of another search by use of the "<done>" and "<set>" tags.

Anytime you have a single result in the final output of a search on a dashboard, your should be able to tokenize this value by using these (<done>|<progress>)(<condition>)?(<set>|<eval>) and referencing

$result.<fieldname>$ where <fieldname> is the fieldname of the valiue you are trying to tokenize from the search.

Apologies if this isn't helpful but I am struggling to follow your questions without more context.

And as for the usage of the "fields" command, I was just removing the _time field (| fields - _time) from results as it is not required to display the percentage result on the dashboard panel.

[varsh_6_8_6]

Hi
I am stuck in a similar situation where the following command works.

The query is when the numerator and the denominator are zero I get the following error message
"Error in 'EvalCommand": Type checking failed. '"' only takes numbers" I tried it through if statement but still it doesn't work. Could you help me on this?

[mgarland]

O interesting! I thought I could reference "$data_source.result$" but I see that you need to tokenize it to make the result available. Also I thought there was some kind of automatic binding where an update to one component would be available through a binding to another component that references a token. So I need to use the done handler to create the token, as you show with XML.

Unfortunately, my page markup is in JSON and my effort at translation does not work. The JSON will not save:

"ds_lo0yYuYR": {
			"type": "ds.chain",
			"options": {
				"query": "| where type=\"SHIP_FROM_STORE\"\n| stats count as sfsCount",
				"done": {
					"set": {
						"token": {
							"Numerator": "$result.count$"
						}
					}
				},
				"extend": "ds_z3a1i32Y",
				"enableSmartSources": true
			},
			"name": "SFS_Count"
		},

[dtburrows3]

Oh wow okay, you are using dashboard studio which is pretty different than legacy XML dashboards.
I can try doing your use-case using dashboard studio and see if I can get it figured it out.

[mgarland]

How/why are you using the fields operator here?