Splunk Search

How to display a Total Users label within Title of Pie Chart?

justdan23
Path Finder

I have a Panel on my Dashboard with a Chart showing the users who use the system.

The Chart shows the first 11 Users, but there is one pie slice showing "Other" to contain the remaining.

I'm trying to modify the Source of a Chart/Panel to display a Label under the Title showing the Total Users.

I'm using the following to create my Chart against an IIS log:

index=_* OR index=* sourcetype=iis | eval UN=upper(UN) | rename UN as Username | stats count (Username) as Total by Username | eval Username=Username." (".Total.")"

Is there a way to display a Label of the count of unique Username values under the Title or somewhere on the Chart? I tried using "", but the documentation is scarce.

<done>
   <eval token="resultcount_tok">$job.resultCount$</eval>
</done>

Thoughts?

0 Karma
1 Solution

Sukisen1981
Champion

Built this on the default _audit index, so that you can use the xml as is, try this

<dashboard>
  <label>pie</label>

        <search>
          <query>index="_audit"
| stats dc(action) as Total by action
| eval action=action." (".Total.")"</query>
<done>
    <eval token="rslt">$job.resultCount$</eval>
 </done>
          <earliest>-60m@m</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>


  <row>
    <panel>
      <title>Title - $rslt$</title>
      <chart>
        <search>
          <query>index="_audit"
| stats count(action) as Total by action
| eval action=action." (".Total.")"</query>
          <earliest>-60m@m</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="charting.chart">pie</option>
        <option name="charting.drilldown">none</option>
      </chart>
    </panel>
  </row>
</dashboard>

View solution in original post

Sukisen1981
Champion

Built this on the default _audit index, so that you can use the xml as is, try this

<dashboard>
  <label>pie</label>

        <search>
          <query>index="_audit"
| stats dc(action) as Total by action
| eval action=action." (".Total.")"</query>
<done>
    <eval token="rslt">$job.resultCount$</eval>
 </done>
          <earliest>-60m@m</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>


  <row>
    <panel>
      <title>Title - $rslt$</title>
      <chart>
        <search>
          <query>index="_audit"
| stats count(action) as Total by action
| eval action=action." (".Total.")"</query>
          <earliest>-60m@m</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="charting.chart">pie</option>
        <option name="charting.drilldown">none</option>
      </chart>
    </panel>
  </row>
</dashboard>
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...