I have the entry below in my dashboard which shows the percent value in pie chart, but defaults to 3 decimal places. Can I change it to 1?
Below is my search. Please let me know if any change to search can help?
| pivot PIVOT_NAME $STATE$ dc(ticket_id) AS Count SPLITROW src_user_category AS Source FILTER affect_dest is $APPLICATION|s$ FILTER src_user_category is $SOURCE|s$ FILTER status_name is $status|s$ FILTER severity is $severity|s$ FILTER affect_dest is $application|s$ FILTER category is $category|s$ SORT 100 src_user_category ROWSUMMARY 0 COLSUMMARY 0 NUMCOLS 0 SHOWOTHER 1
Pie chart calculates its own <field>% value for building accurate slices for the pie chart. While we can not round off that percentage, we can calculate rounded percentage our self and add to the label field so that rounded value is displayed as when the Pie chart loads. Following steps are required:
Step 1: <your search>|eventstats count(<field name>) as Total
Use eventstats to count the total of events to be plotted on Pie Chart. This could be either count or count(<field name>) as per need.
Step 2: stats count(<field name>) as Count values(Total) as Total by <group field name>|
Actual stats command for the pie chart. Aggregate function values(Total) will give the distinct value of final total (or 100% value). Use by clause to group events in order to form slices for the pie chart.
Step 3: eval percent=round((Count/Total)*100,2)|
Calculate percent based on Count and Total calculated in previous step.
Step 4: eval <group field name>= <group field name>."(Count=".Count."), ".percent."%"|
Change the Group Field Name(which forms slices of the pie chart) to contain Group Name, Count and percent for each slice.
Step 5: table <group field name>, Count
Label(Group Field Name) and value (Count) for the Pie Chart Visualization.
Example: Modify and add to your existing search. Where foo is the statistical field for values of slices and bar is the group by field for label of slices of pie chart.
|eventstats count(foo) as Total
stats count(foo) as Count values(Total) as Total by bar|
eval *bar** = bar."(Count=".Count."), ".percent."%"|
table bar, foo
Here is a example of round stats average to 2 decimal places, if you like to 1 decimal, try to replace
1 in the query below
stats count by field1 | stats avg(count) as avgcount | eval avgcount=round(avg_count,2) |
Sorry, somehow my dashboard xml entry was missed from the original post. Below is the entry I have.
and it takes 3 as the default value for number of decimal places. Eval did not work for me. Can you help please?