Splunk Search

How to create a graphical bar for percentages in a table with a Sparkline

timmalos
Communicator

Hi guys !

If you want to change your percentage column into a nice view, you are at the right place 🙂

I'l answer to this question : Display a bar in a table with Sparklines.

alt text

1 Solution

timmalos
Communicator

First of all, we need to go to the Sparkline documentation page :
http://omnipotent.net/jquery.sparkline/#s-about
If you play with the generator you can see ye need a "Bullet" sparkline.

To add this sparkline into your tables, we need to cheat a little cause bullet sparklines want datas like this : target,performance,range. So a stats sparkline() will be difficult.

To continue you need a search returning at least a field containing a value between 0 and 100, we will call it "value" in the next example search.
We create the percentage column like this :

search |eval Percentage= "##__SPARKLINE__##,0,"+value+",100"| makemv delim="," Percentage

Here we create a new field Percentage that Splunk will interprate as a Sparkline.

If you run this search in the search view, you will have a sparkline with 3 values because by default its a "line" sparkline.

We need to create a view to add parameters. I use advanced xml. You have to and add the following conguration to your table :

<module name="SimpleResultsTable">
<param name="count">100</param>

<param name="fieldFormats"><param name="Percentage"><list>
    <param name="type">sparkline</param>
    <param name="options">
        <param name="type">bullet</param>
        <param name="height">20px</param>
        <param name="width">150px</param>
        <param name="targetWidth">1px</param>
        <param name="targetColor">#007f7f</param>
        <param name="performanceColor">#007f7f</param>
    </param></list>
</param></param>

</module

And here we go, a nice way to display percentage values !
Hope it will be usefull for some of you 🙂

View solution in original post

timmalos
Communicator

First of all, we need to go to the Sparkline documentation page :
http://omnipotent.net/jquery.sparkline/#s-about
If you play with the generator you can see ye need a "Bullet" sparkline.

To add this sparkline into your tables, we need to cheat a little cause bullet sparklines want datas like this : target,performance,range. So a stats sparkline() will be difficult.

To continue you need a search returning at least a field containing a value between 0 and 100, we will call it "value" in the next example search.
We create the percentage column like this :

search |eval Percentage= "##__SPARKLINE__##,0,"+value+",100"| makemv delim="," Percentage

Here we create a new field Percentage that Splunk will interprate as a Sparkline.

If you run this search in the search view, you will have a sparkline with 3 values because by default its a "line" sparkline.

We need to create a view to add parameters. I use advanced xml. You have to and add the following conguration to your table :

<module name="SimpleResultsTable">
<param name="count">100</param>

<param name="fieldFormats"><param name="Percentage"><list>
    <param name="type">sparkline</param>
    <param name="options">
        <param name="type">bullet</param>
        <param name="height">20px</param>
        <param name="width">150px</param>
        <param name="targetWidth">1px</param>
        <param name="targetColor">#007f7f</param>
        <param name="performanceColor">#007f7f</param>
    </param></list>
</param></param>

</module

And here we go, a nice way to display percentage values !
Hope it will be usefull for some of you 🙂

View solution in original post

Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!