Splunk Search

How can I customize my chart with a new y-axis label?

michaelrosello
Path Finder

Is there a way to customize the column charts label, or the y-axis?

What I want to do is create a column with the count of the field on the bar part of the chart, while on the y-axis is the percentage of that count.

index="index"
 | eval SLA_status = if(('Resolution SLA' ="Yes"),"Met","Missed")
 | timechart count by SLA_status
 | untable _time SLA_status count
 | eventstats sum(count) as Total by _time
 | eval perc=round(count*100/Total,2)
 | eval _time=strftime(_time, "%b %Y")
 | table _time SLA_status perc
 | xyseries _time SLA_status perc
Tags (4)
0 Karma

somesoni2
Revered Legend

What's your current search?

0 Karma

michaelrosello
Path Finder

@somesoni2 I've updated my post with my search.

0 Karma

DalJeanis
Legend

You can put an alternate measure on the right, but your calculation and formatting might be complicated. Obviously, if you were doing percentage over time, then the Y number would not generally be consistent anyway, but if you are doing a static moment or period, then that could work well enough.

0 Karma

michaelrosello
Path Finder

Hi, I've updated my post with my search.

0 Karma
Get Updates on the Splunk Community!

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...