Splunk Search

## How to show a percentage of the total events in a pie chart

Path Finder

I feel dumb for asking something so simple, but I can't make this work. I'm trying to show a percentage I've calculated as a piechart:

``````| dbxquery query=stuff | stats count(eval(Start_Date_Time >
End_Date_Time)) as breach count as total | eval percent=breach/total*100 | eval total=total/total*100 | chart max(percent) over total
``````

As you can see, I calculated both the percent of events where the start time is greater than the end time, and the corresponding total, which, of course is 100%. All I need to do now is show it in a pie chart. I calculated the total percent due to the chart only showing a solid block of color for my percent. I was hoping that I could use it to show the percentage correctly, but I was wrong on that.

Also, I can't use top; I need to consider all the events, not just the top values.

Tags (3)
1 Solution
Esteemed Legend

Try this:

``````| dbxquery query=stuff
| stats count(eval(Start_Date_Time > End_Date_Time)) as breach count as total
| eval breach=100*breach/total
| eval non-breach=100-breach
| transpose
``````
Esteemed Legend

Try this:

``````| dbxquery query=stuff
| stats count(eval(Start_Date_Time > End_Date_Time)) as breach count as total
| eval breach=100*breach/total
| eval non-breach=100-breach
| transpose
``````
Path Finder

This actually works very well. I just made a minor modification to get rid of the total field.

`````` | dbxquery query=stuff
| stats count(eval(Start_Date_Time > End_Date_Time)) as breach count as total
| eval breach=100*breach/total
| eval non-breach=100-breach
| transpose
``````

Now I'm just going to figure out how to show count with it. Thank you

Esteemed Legend

If you don't do the percentage and just show raw values for `breach` and `non-breach` it should show both count and percent. SplunkTrust

Pie chart requires a by-clause

Try

| chart max(percent) by something

You don't even have to calculate the percent

This might work:

| stats max(breach) by _time

You need your data to end up with multiple rows and more than one column like this:

hostname,breach_count
HostA,25
HostB,75

Then | stats max(breach_count) by hostname
would have a pie chart where the total is 100 and HostA would be 25% and HostB would be 75%. State of Splunk Careers