help for formatting a pie chart

[jip31]

Hi

I use the search below in order to display the data in a pie chart

| inputlookup host.csv 
| lookup PanaBatteryStatus.csv "Hostname00" as host OUTPUT BatteryTemp00 
| where BatteryTemp00 > 30 
| stats count as NbHostBattSup30
| appendcols 
    [| inputlookup host.csv 
    | stats count as NbIndHost] 
| eval NbHostBattInf30 = (NbIndHost - NbHostBattSup30) 
| eval NbHostBattSup30=NbHostBattSup30, NbHostBattInf30=NbHostBattInf30 
| table NbHostBattSup30 NbHostBattInf30
| transpose

I would like to just display one decimal
So I do this but it doesn't works

    | eval NbHostBattSup30=round(NbHostBattSup30, 1), NbHostBattInf30=round(NbHostBattInf30, 1)

I would also have the result in bold and to display the integer value in addition to the percentage
could you help me please??

[woodcock]

Try this:

| inputlookup host.csv 
| lookup PanaBatteryStatus.csv "Hostname00" as host OUTPUT BatteryTemp00 
| where BatteryTemp00 > 30 
| stats count as NbHostBattSup30
| appendcols 
[| inputlookup host.csv 
| stats count as NbIndHost] 
| eval NbHostBattInf30 = (NbIndHost - NbHostBattSup30) 
| eval NbHostBattSup30=NbHostBattSup30, NbHostBattInf30=NbHostBattInf30 
| table NbHostBattSup30 NbHostBattInf30 
| untable foo key value
| fields - foo

[jip31]

hi
with this, I have any percentage...

[woodcock]

More words.

[Sukisen1981 · Accepted solution]

Try this on your default _audit index.
Copy paste this code and run

index="_audit" 
| stats count by info
| eventstats sum(count) as count1
| eval perc=round(count*100/count1,1)
| eval info=info+"-"+"count:"+count+","+"percentage:"+perc
| fields info,perc

[jip31]

I have no right on this index and I try to adapt your code in mine but it doesnt works...

[woodcock]

Did you mean to click Answer? It doesn't really make sense to, if you cannot test it.

[Sukisen1981]

Hi @jip31 - Can you not install the free splunk enterprise on your local and try out the above code?