I have total of 7M users. My splunk query shows the count of completed users. I want to draw a pie chart showing completed users vs Total users.
So far I have gotten this far
<< my query>> | eval TotalMax=7000000 | stats count(Path) as completed | eval perc=(completed/TotalMax)/100 | table completed,perc
count(Path) which is same as completed comes out as 200000
But perc is not getting calculated. Am I missing anything ?
--Sunray
Hi @balash1979,
After stats command only fields that stats outputs are exist. On your case you are loosing TotalMax field, so perc cannot be calculated. Below should work;
<< my query>>
| stats count(Path) as completed
| eval TotalMax=7000000
| eval perc=(completed/TotalMax)/100
| table completed,perc
OR
<< my query>>
| eval TotalMax=7000000
| stats count(Path) as completed values(TotalMax) as TotalMax
| eval perc=(completed/TotalMax)/100
| table completed,perc
If this reply helps you an upvote is appreciated.
Thanks. If i add "table completed, perc" , i can get the correct data.
How can i display this as a pie chart ? in the pie chart, i would like to see % completed out of the total. Thanks
Hi @balash1979,
After stats command only fields that stats outputs are exist. On your case you are loosing TotalMax field, so perc cannot be calculated. Below should work;
<< my query>>
| stats count(Path) as completed
| eval TotalMax=7000000
| eval perc=(completed/TotalMax)/100
| table completed,perc
OR
<< my query>>
| eval TotalMax=7000000
| stats count(Path) as completed values(TotalMax) as TotalMax
| eval perc=(completed/TotalMax)/100
| table completed,perc
If this reply helps you an upvote is appreciated.