Splunk Search

How to round a percentage value in a pie chart to 1 decimal place?

dvg06
Path Finder

Hi,

I have the entry below in my dashboard which shows the percent value in pie chart, but defaults to 3 decimal places. Can I change it to 1?

Below is my search. Please let me know if any change to search can help?

| pivot PIVOT_NAME $STATE$ dc(ticket_id) AS Count SPLITROW src_user_category AS Source FILTER affect_dest is $APPLICATION|s$ FILTER src_user_category is $SOURCE|s$ FILTER status_name is $status|s$ FILTER severity is $severity|s$ FILTER affect_dest is $application|s$ FILTER category is $category|s$ SORT 100 src_user_category ROWSUMMARY 0 COLSUMMARY 0 NUMCOLS 0 SHOWOTHER 1
0 Karma

niketn
Legend

Pie chart calculates its own <field>% value for building accurate slices for the pie chart. While we can not round off that percentage, we can calculate rounded percentage our self and add to the label field so that rounded value is displayed as when the Pie chart loads. Following steps are required:

Step 1: <your search>|eventstats count(<field name>) as Total
Use eventstats to count the total of events to be plotted on Pie Chart. This could be either count or count(<field name>) as per need.

Step 2: stats count(<field name>) as Count values(Total) as Total by <group field name>|
Actual stats command for the pie chart. Aggregate function values(Total) will give the distinct value of final total (or 100% value). Use by clause to group events in order to form slices for the pie chart.

Step 3: eval percent=round((Count/Total)*100,2)|
Calculate percent based on Count and Total calculated in previous step.

Step 4: eval <group field name>= <group field name>."(Count=".Count."), ".percent."%"|
Change the Group Field Name(which forms slices of the pie chart) to contain Group Name, Count and percent for each slice.

Step 5: table <group field name>, Count
Label(Group Field Name) and value (Count) for the Pie Chart Visualization.

Example: Modify and add to your existing search. Where foo is the statistical field for values of slices and bar is the group by field for label of slices of pie chart.

|eventstats count(foo) as Total
stats count(foo) as Count values(Total) as Total by bar|
eval percent=round((Count/Total)100,2)|
eval **bar
* = bar."(Count=".Count."), ".percent."%"|
table bar, foo

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

gyslainlatsa
Motivator

hi dvg06,

Here is a example of round stats average to 2 decimal places, if you like to 1 decimal, try to replace 2 by 1 in the query below

stats count by field1 | stats avg(count) as avg_count | eval avg_count=round(avg_count,2) |

0 Karma

javiergn
Super Champion

Have you tried?

eval percent = round(percent,1)
0 Karma

dvg06
Path Finder

Sorry, somehow my dashboard xml entry was missed from the original post. Below is the entry I have.

<option name="charting.chart.showPercent">true</option>

and it takes 3 as the default value for number of decimal places. Eval did not work for me. Can you help please?

0 Karma
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...