Splunk Search

Is it possible to add a legend to a pie chart?

Contributor

I read splunk document on adding legend for pie chart. But I don't see that option for pie chart. This is my search:

index="datacdr" sourcetype="csv" | eval "Call Duration"=replace('Call Duration',"\"","") | convert dur2sec("Call Duration") as "CDinsec" | eval "cd"=case(CDinsec<=900 AND CDinsec>0,"Under 15mins", CDinsec<=1800 AND CDinsec>0,"Under 30mins", CDinsec<=2700 AND CDinsec>0,"Under 45mins", CDinsec<=3600 AND CDinsec>0,"Under an hour",CDinsec<=4500 AND CDinsec>0,"Under 1:15 hour", CDinsec>4500 AND CDinsec>0, "Above 1:15 hour") | stats count by cd

I want to display the count of them around the pie chart and have the legend on the side. I needed this so that I could export it to pdf and it still make sense instead of showing the user the name of them only.

0 Karma
1 Solution

Super Champion

would it work to add the count to the legend? I don't think you can add the legend to the side, i think the only option currently is to have it attached to each slice. but if you added |eval cd=cd+" - "+count to the end of the query, then it would add the count value to the end of the labels. It isn't exactly what you want, but a workaround

there is an option called charting.chart.showPercent that you could mark as true in the simpleXML that would show the percentages, not the count, of each slice. https://docs.splunk.com/Documentation/SplunkCloud/6.6.1/Viz/ChartConfigurationReference#Pie_charts

View solution in original post

Super Champion

would it work to add the count to the legend? I don't think you can add the legend to the side, i think the only option currently is to have it attached to each slice. but if you added |eval cd=cd+" - "+count to the end of the query, then it would add the count value to the end of the labels. It isn't exactly what you want, but a workaround

there is an option called charting.chart.showPercent that you could mark as true in the simpleXML that would show the percentages, not the count, of each slice. https://docs.splunk.com/Documentation/SplunkCloud/6.6.1/Viz/ChartConfigurationReference#Pie_charts

View solution in original post