Splunk Search

How to show values and percentages on hover over columns in 100% stacked column chart?



I have a graph that I'm displaying as a 100% stacked column chart. Even though the Y-Axis is set to 0-100 I still see just the raw/absolute values when I mouse over the colored sections of the columns. Is there a way to make Splunk show the raw/absolute value and the percentage, like it does with the pie chart?

I've been able to get around this in one of my searches by using the "appendcols" command and then taking the percent of one column compared to both added together, but I'm not positive that method will work very well when I have more than 2 series.



0 Karma


You can use the foreach command to calculate the percentage for each column iteratively.

In my example, I'm creating a timechart counting different values of my variable view_version, and formatting the results as a percentage in a 100 Percent Stacked column chart.

base_search | timechart count by view_version | addtotals fieldname=_Total | foreach * [eval <<FIELD>> = '<<FIELD>>' * 100 / _Total] | fields - _Total

The fields command removes the _Total field from the final table.

Source: http://answers.splunk.com/answers/169174/percentage-charting-over-time-percentage-of-fieldc.html#ans...


Hi @devinbrady , yes its working as what i need exactly but x axis names are not displaying. example view_version names in your case.

0 Karma

Path Finder

I'd love to see this answered as well!

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!