Splunk Search

Is it possible to add a legend to a pie chart?

tamduong16
Contributor

I read splunk document on adding legend for pie chart. But I don't see that option for pie chart. This is my search:

index="datacdr" sourcetype="csv" | eval "Call Duration"=replace('Call Duration',"\"","") | convert dur2sec("Call Duration") as "CDinsec" | eval "cd"=case(CDinsec<=900 AND CDinsec>0,"Under 15mins", CDinsec<=1800 AND CDinsec>0,"Under 30mins", CDinsec<=2700 AND CDinsec>0,"Under 45mins", CDinsec<=3600 AND CDinsec>0,"Under an hour",CDinsec<=4500 AND CDinsec>0,"Under 1:15 hour", CDinsec>4500 AND CDinsec>0, "Above 1:15 hour") | stats count by cd

I want to display the count of them around the pie chart and have the legend on the side. I needed this so that I could export it to pdf and it still make sense instead of showing the user the name of them only.

0 Karma
1 Solution

cmerriman
Super Champion

would it work to add the count to the legend? I don't think you can add the legend to the side, i think the only option currently is to have it attached to each slice. but if you added |eval cd=cd+" - "+count to the end of the query, then it would add the count value to the end of the labels. It isn't exactly what you want, but a workaround

there is an option called charting.chart.showPercent that you could mark as true in the simpleXML that would show the percentages, not the count, of each slice. https://docs.splunk.com/Documentation/SplunkCloud/6.6.1/Viz/ChartConfigurationReference#Pie_charts

View solution in original post

cmerriman
Super Champion

would it work to add the count to the legend? I don't think you can add the legend to the side, i think the only option currently is to have it attached to each slice. but if you added |eval cd=cd+" - "+count to the end of the query, then it would add the count value to the end of the labels. It isn't exactly what you want, but a workaround

there is an option called charting.chart.showPercent that you could mark as true in the simpleXML that would show the percentages, not the count, of each slice. https://docs.splunk.com/Documentation/SplunkCloud/6.6.1/Viz/ChartConfigurationReference#Pie_charts

Get Updates on the Splunk Community!

Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars this month. This ...

They're back! Join the SplunkTrust and MVP at .conf24

With our highly anticipated annual conference, .conf, comes the fez-wearers you can trust! The SplunkTrust, as ...

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...