Splunk Search

How to view percentages in column chart instead of total values without calculating percentages in search?

Motivator

Hi,

I'm using a column visualization and the stack mode "100%". It would be nice to have the percentages in the chart instead of total values. Is this possible without calculating the percentages in the search?

BR

Heinz

1 Solution

SplunkTrust
SplunkTrust

Calculating that in search isn't hard though:

index=_internal | timechart count by sourcetype | addtotals fieldname=_Total | foreach * [eval <<FIELD>> = '<<FIELD>>' * 100 / _Total] | fields - _Total

You can move the addtotals | foreach | fields into a macro and reuse it.

View solution in original post

SplunkTrust
SplunkTrust

Calculating that in search isn't hard though:

index=_internal | timechart count by sourcetype | addtotals fieldname=_Total | foreach * [eval <<FIELD>> = '<<FIELD>>' * 100 / _Total] | fields - _Total

You can move the addtotals | foreach | fields into a macro and reuse it.

View solution in original post

Motivator

Awesome, didn't know it can be done so easy. Thanks!

0 Karma

SplunkTrust
SplunkTrust

I don't think so.