Splunk Search

How to add percentage in unstacked bar chart?

ritupatil02
Path Finder

I have a bar chart as shown below. I want to display the percentage of Error, Warn and Info as single value visualisation as another panel. How can I do that?

The query for bar chart panel is:

| stats count by lvl | transpose header_field=lvl column_name=lvl

Capture.PNG

Labels (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
| stats count by lvl 
| eventstats sum(count) as total
| eval count=100*count/total
| fields - total
| transpose header_field=lvl column_name=lvl
| fields - lvl

Then set visualisation to single trellis mode - you may want to change the number format precision to something other than integers

View solution in original post

kamlesh_vaghela
SplunkTrust
SplunkTrust

@ritupatil02 

Can you please try this?

| stats count by lvl  
| eventstats sum(count) as Total | eval perc=round(count*100/Total,2)
| xyseries count lvl  perc

Thanks
KV
▄︻̷̿┻̿═━一

If any of my reply helps you to solve the problem Or gain knowledge, an upvote would be appreciated. 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| stats count by lvl 
| eventstats sum(count) as total
| eval count=100*count/total
| fields - total
| transpose header_field=lvl column_name=lvl
| fields - lvl

Then set visualisation to single trellis mode - you may want to change the number format precision to something other than integers

ritupatil02
Path Finder

What if I want 3 different single value panels for Error, Info and Warn resp. Is that possible?

Tags (1)
0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@ritupatil02  

Like this? 

 

Screenshot 2021-06-15 at 9.04.53 PM.png

 

0 Karma

ritupatil02
Path Finder

No. Instead of using trellis, can we have the 3 percentages in 3 different single value panels

0 Karma

ritupatil02
Path Finder

Hey that worked.. Thankyou!

Tags (1)
0 Karma
Get Updates on the Splunk Community!

Splunk Search APIを使えば調査過程が残せます

   このゲストブログは、JCOM株式会社の情報セキュリティ本部・専任部長である渡辺慎太郎氏によって執筆されました。 Note: This article is published in both Japanese ...

Integrating Splunk Search API and Quarto to Create Reproducible Investigation ...

 Splunk is More Than Just the Web Console For Digital Forensics and Incident Response (DFIR) practitioners, ...

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...