How can I add the total row count somewhere on the pie chart?

[brian661]

I have a search string for creating a pie chart
If I want to show the total rows on the top or anywhere of the chart.
how can I do it?

myLogSearch| stats count(eval(like(subject,"Maths"))) as Math_total_score, count(eval(like(subject, "English") AND attended == true ))| transpose

[niketn]

Refer to my answer on putting label in Pie Chart. You would need to use eventstats to get the Total and then based on each slice's value compute the percent. Finally, you need to change the label name itself to show Total and Percent. This way you labels will show both without hovering over it.

https://answers.splunk.com/answers/351010/how-to-round-a-percentage-value-in-a-pie-chart-to.html#ans...

[martin_mueller · Accepted solution]

Take a second panel - e.g. single value or HTML - and display the total there.

[martin_mueller]

Something like this pseudo-SimpleXML:

<dashboard>
  <row>
    <panel>
      <chart>
        <search id="pie">your regular pie search</search>
        your regular pie chart
      </chart>
    </panel>
  </row>
  <row>
    <panel>
      <single>
        <search base="pie">stats sum('row 1') as count</search>
      </single>
    <panel>
  </row>
</dashboard>

[brian661]

Do you mean just add a second panel with a search string for getting the total count? this is my current solution but just want to search for a advance solution.

[rjthibod]

Yes, that is the only solution that doesn't involve doing in JS. If it were me, I would use a second post-processing search to sum the sow 1 field after transpose, and then use the search event handler <done> to set a token value that contains the sum value. Then you can display that total in an HTML string atop of the Pie Chart panel. Otherwise, you can put the results of the second post-processing search into a single value panel like @martin_mueller suggested.