Splunk Search

How to create a graphical bar for percentages in a table with a Sparkline

Communicator

Hi guys !

If you want to change your percentage column into a nice view, you are at the right place 🙂

I'l answer to this question : Display a bar in a table with Sparklines.

alt text

1 Solution

Communicator

First of all, we need to go to the Sparkline documentation page :
http://omnipotent.net/jquery.sparkline/#s-about
If you play with the generator you can see ye need a "Bullet" sparkline.

To add this sparkline into your tables, we need to cheat a little cause bullet sparklines want datas like this : target,performance,range. So a stats sparkline() will be difficult.

To continue you need a search returning at least a field containing a value between 0 and 100, we will call it "value" in the next example search.
We create the percentage column like this :

search |eval Percentage= "##__SPARKLINE__##,0,"+value+",100"| makemv delim="," Percentage

Here we create a new field Percentage that Splunk will interprate as a Sparkline.

If you run this search in the search view, you will have a sparkline with 3 values because by default its a "line" sparkline.

We need to create a view to add parameters. I use advanced xml. You have to and add the following conguration to your table :

<module name="SimpleResultsTable">
<param name="count">100</param>

<param name="fieldFormats"><param name="Percentage"><list>
    <param name="type">sparkline</param>
    <param name="options">
        <param name="type">bullet</param>
        <param name="height">20px</param>
        <param name="width">150px</param>
        <param name="targetWidth">1px</param>
        <param name="targetColor">#007f7f</param>
        <param name="performanceColor">#007f7f</param>
    </param></list>
</param></param>

</module

And here we go, a nice way to display percentage values !
Hope it will be usefull for some of you 🙂

View solution in original post

Communicator

First of all, we need to go to the Sparkline documentation page :
http://omnipotent.net/jquery.sparkline/#s-about
If you play with the generator you can see ye need a "Bullet" sparkline.

To add this sparkline into your tables, we need to cheat a little cause bullet sparklines want datas like this : target,performance,range. So a stats sparkline() will be difficult.

To continue you need a search returning at least a field containing a value between 0 and 100, we will call it "value" in the next example search.
We create the percentage column like this :

search |eval Percentage= "##__SPARKLINE__##,0,"+value+",100"| makemv delim="," Percentage

Here we create a new field Percentage that Splunk will interprate as a Sparkline.

If you run this search in the search view, you will have a sparkline with 3 values because by default its a "line" sparkline.

We need to create a view to add parameters. I use advanced xml. You have to and add the following conguration to your table :

<module name="SimpleResultsTable">
<param name="count">100</param>

<param name="fieldFormats"><param name="Percentage"><list>
    <param name="type">sparkline</param>
    <param name="options">
        <param name="type">bullet</param>
        <param name="height">20px</param>
        <param name="width">150px</param>
        <param name="targetWidth">1px</param>
        <param name="targetColor">#007f7f</param>
        <param name="performanceColor">#007f7f</param>
    </param></list>
</param></param>

</module

And here we go, a nice way to display percentage values !
Hope it will be usefull for some of you 🙂

View solution in original post

State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!