Splunk Search

How to display a Total Users label within Title of Pie Chart?

justdan23
Path Finder

I have a Panel on my Dashboard with a Chart showing the users who use the system.

The Chart shows the first 11 Users, but there is one pie slice showing "Other" to contain the remaining.

I'm trying to modify the Source of a Chart/Panel to display a Label under the Title showing the Total Users.

I'm using the following to create my Chart against an IIS log:

index=_* OR index=* sourcetype=iis | eval UN=upper(UN) | rename UN as Username | stats count (Username) as Total by Username | eval Username=Username." (".Total.")"

Is there a way to display a Label of the count of unique Username values under the Title or somewhere on the Chart? I tried using "", but the documentation is scarce.

<done>
   <eval token="resultcount_tok">$job.resultCount$</eval>
</done>

Thoughts?

0 Karma
1 Solution

Sukisen1981
Champion

Built this on the default _audit index, so that you can use the xml as is, try this

<dashboard>
  <label>pie</label>

        <search>
          <query>index="_audit"
| stats dc(action) as Total by action
| eval action=action." (".Total.")"</query>
<done>
    <eval token="rslt">$job.resultCount$</eval>
 </done>
          <earliest>-60m@m</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>


  <row>
    <panel>
      <title>Title - $rslt$</title>
      <chart>
        <search>
          <query>index="_audit"
| stats count(action) as Total by action
| eval action=action." (".Total.")"</query>
          <earliest>-60m@m</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="charting.chart">pie</option>
        <option name="charting.drilldown">none</option>
      </chart>
    </panel>
  </row>
</dashboard>

View solution in original post

Sukisen1981
Champion

Built this on the default _audit index, so that you can use the xml as is, try this

<dashboard>
  <label>pie</label>

        <search>
          <query>index="_audit"
| stats dc(action) as Total by action
| eval action=action." (".Total.")"</query>
<done>
    <eval token="rslt">$job.resultCount$</eval>
 </done>
          <earliest>-60m@m</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>


  <row>
    <panel>
      <title>Title - $rslt$</title>
      <chart>
        <search>
          <query>index="_audit"
| stats count(action) as Total by action
| eval action=action." (".Total.")"</query>
          <earliest>-60m@m</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="charting.chart">pie</option>
        <option name="charting.drilldown">none</option>
      </chart>
    </panel>
  </row>
</dashboard>
Get Updates on the Splunk Community!

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...