Splunk Search

How to display a Total Users label within Title of Pie Chart?

Path Finder

I have a Panel on my Dashboard with a Chart showing the users who use the system.

The Chart shows the first 11 Users, but there is one pie slice showing "Other" to contain the remaining.

I'm trying to modify the Source of a Chart/Panel to display a Label under the Title showing the Total Users.

I'm using the following to create my Chart against an IIS log:

index=_* OR index=* sourcetype=iis | eval UN=upper(UN) | rename UN as Username | stats count (Username) as Total by Username | eval Username=Username." (".Total.")"

Is there a way to display a Label of the count of unique Username values under the Title or somewhere on the Chart? I tried using "", but the documentation is scarce.

<done>
   <eval token="resultcount_tok">$job.resultCount$</eval>
</done>

Thoughts?

0 Karma
1 Solution

Champion

Built this on the default _audit index, so that you can use the xml as is, try this

<dashboard>
  <label>pie</label>

        <search>
          <query>index="_audit"
| stats dc(action) as Total by action
| eval action=action." (".Total.")"</query>
<done>
    <eval token="rslt">$job.resultCount$</eval>
 </done>
          <earliest>-60m@m</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>


  <row>
    <panel>
      <title>Title - $rslt$</title>
      <chart>
        <search>
          <query>index="_audit"
| stats count(action) as Total by action
| eval action=action." (".Total.")"</query>
          <earliest>-60m@m</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="charting.chart">pie</option>
        <option name="charting.drilldown">none</option>
      </chart>
    </panel>
  </row>
</dashboard>

View solution in original post

Champion

Built this on the default _audit index, so that you can use the xml as is, try this

<dashboard>
  <label>pie</label>

        <search>
          <query>index="_audit"
| stats dc(action) as Total by action
| eval action=action." (".Total.")"</query>
<done>
    <eval token="rslt">$job.resultCount$</eval>
 </done>
          <earliest>-60m@m</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>


  <row>
    <panel>
      <title>Title - $rslt$</title>
      <chart>
        <search>
          <query>index="_audit"
| stats count(action) as Total by action
| eval action=action." (".Total.")"</query>
          <earliest>-60m@m</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="charting.chart">pie</option>
        <option name="charting.drilldown">none</option>
      </chart>
    </panel>
  </row>
</dashboard>

View solution in original post