Splunk Search

How to create a graphical bar for percentages in a table with a Sparkline

timmalos
Communicator

Hi guys !

If you want to change your percentage column into a nice view, you are at the right place 🙂

I'l answer to this question : Display a bar in a table with Sparklines.

alt text

1 Solution

timmalos
Communicator

First of all, we need to go to the Sparkline documentation page :
http://omnipotent.net/jquery.sparkline/#s-about
If you play with the generator you can see ye need a "Bullet" sparkline.

To add this sparkline into your tables, we need to cheat a little cause bullet sparklines want datas like this : target,performance,range. So a stats sparkline() will be difficult.

To continue you need a search returning at least a field containing a value between 0 and 100, we will call it "value" in the next example search.
We create the percentage column like this :

search |eval Percentage= "##__SPARKLINE__##,0,"+value+",100"| makemv delim="," Percentage

Here we create a new field Percentage that Splunk will interprate as a Sparkline.

If you run this search in the search view, you will have a sparkline with 3 values because by default its a "line" sparkline.

We need to create a view to add parameters. I use advanced xml. You have to and add the following conguration to your table :

<module name="SimpleResultsTable">
<param name="count">100</param>

<param name="fieldFormats"><param name="Percentage"><list>
    <param name="type">sparkline</param>
    <param name="options">
        <param name="type">bullet</param>
        <param name="height">20px</param>
        <param name="width">150px</param>
        <param name="targetWidth">1px</param>
        <param name="targetColor">#007f7f</param>
        <param name="performanceColor">#007f7f</param>
    </param></list>
</param></param>

</module

And here we go, a nice way to display percentage values !
Hope it will be usefull for some of you 🙂

View solution in original post

timmalos
Communicator

First of all, we need to go to the Sparkline documentation page :
http://omnipotent.net/jquery.sparkline/#s-about
If you play with the generator you can see ye need a "Bullet" sparkline.

To add this sparkline into your tables, we need to cheat a little cause bullet sparklines want datas like this : target,performance,range. So a stats sparkline() will be difficult.

To continue you need a search returning at least a field containing a value between 0 and 100, we will call it "value" in the next example search.
We create the percentage column like this :

search |eval Percentage= "##__SPARKLINE__##,0,"+value+",100"| makemv delim="," Percentage

Here we create a new field Percentage that Splunk will interprate as a Sparkline.

If you run this search in the search view, you will have a sparkline with 3 values because by default its a "line" sparkline.

We need to create a view to add parameters. I use advanced xml. You have to and add the following conguration to your table :

<module name="SimpleResultsTable">
<param name="count">100</param>

<param name="fieldFormats"><param name="Percentage"><list>
    <param name="type">sparkline</param>
    <param name="options">
        <param name="type">bullet</param>
        <param name="height">20px</param>
        <param name="width">150px</param>
        <param name="targetWidth">1px</param>
        <param name="targetColor">#007f7f</param>
        <param name="performanceColor">#007f7f</param>
    </param></list>
</param></param>

</module

And here we go, a nice way to display percentage values !
Hope it will be usefull for some of you 🙂

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...