Splunk Search

How do I convert the format the of the timechart y-axis values to percent?

HattrickNZ
Motivator

I have a search that is a timechart and the y-axis is showing a min of 0 and a max of 1, with 0.25, 0.5, 0.75 in between. How do I convert this Y-axis values to show that the min is 0 and the max is 100, with 25, 50, 75 in between?

I tried creating a field and using that in the timechart:
eval c84162281_percent=c84162281*100

but it seems to be skewing the data.

Was also thinking of trying fieldformat but no joy.

0 Karma

markthompson
Builder

Correct answer by @stephanefotso

Alternatively, you could use the good ole' GUI and adjust the numbers on the Y axis. Click the Edit Panels and then Click the properties drop down -> Y Axis -> Min value and max value

0 Karma

stephanefotso
Motivator

Thansks Markthompson. Also do not forget to take a look at the problem you asked at the address bellow.
http://answers.splunk.com/answers/227198/use-rangemap-to-change-color-of-whole-panel.html#answer-228....

SGF
0 Karma

stephanefotso
Motivator

Hello! If i understand your problem, you just need to multiplie your y values by 100. Take this as a template, whith the chart command. Just test it, maybe it could help you.

index=_internal| eventstats count by sourcetype| eventstats sum(count) as total by sourcetype | eval percentage=round(count*100/total,1)*100|chart values(percentage) by _time|head 10
SGF
Get Updates on the Splunk Community!

Building Reliable Asset and Identity Frameworks in Splunk ES

 Accurate asset and identity resolution is the backbone of security operations. Without it, alerts are ...

Cloud Monitoring Console - Unlocking Greater Visibility in SVC Usage Reporting

For Splunk Cloud customers, understanding and optimizing Splunk Virtual Compute (SVC) usage and resource ...

Automatic Discovery Part 3: Practical Use Cases

If you’ve enabled Automatic Discovery in your install of the Splunk Distribution of the OpenTelemetry ...