Splunk Search

Pie chart round default percentage

tamduong16
Contributor

I have the following search:

index="monthlycdr" | eval "transporttype"=replace('Transport Type',"\"","") | eval "tt"=case( match(transporttype, "(?i)voice_sip"), "Sip_voice",match(transporttype, "(?i)sIp"), "Sip", match(transporttype, "(?i)voice_H323"), "H323_voice",match(transporttype, "(?i)H323"), "H323", match(transporttype, "(?i)pstn"), "PSTN") | stats count by tt

with the option:

alt text

And this is my result picture:

alt text

I know by default splunk has this percentage to 3 decimals. But is there anyway I could round it to 1? If not, how can I calculate it manually in my search base on the search that I have now? I've tried to calculate the percentage from my search but due to the case statement, I can't figure out a way to calculate the percentage value.

Thanks!

0 Karma
1 Solution

@ tamduong16, This has definitely been answered before. You will have to calculate percent in your query and then replace your Pie chart label to have Name as well as rounded off percent. Then you turn of the showPercent option since your Label itself will display the percent (without hover)

https://answers.splunk.com/answers/351010/how-to-round-a-percentage-value-in-a-pie-chart-to.html
Or
https://answers.splunk.com/answers/589417/how-to-round-the-decimal-percentage-in-a-piechart.html

Try the following search (it will have better performance than yours)

 index="monthlycdr"
| stats count as transportcount by "Transport Type"
| eval transporttype=replace('Transport Type',"\"","") 
| fields - "Transport Type"
| eval transporttype=case( match(transporttype, "voice_sip"), "Sip_voice",match(transporttype, "(?i)sIp"), "Sip", match(transporttype, "(?i)voice_H323"), "H323_voice",match(transporttype, "(?i)H323"), "H323", match(transporttype, "(?i)pstn"), "PSTN")
| eventstats sum(transportcount) as Total
| eval perc=round((transportcount/Total)*100,1)
| eval transporttype=transporttype." (".perc."%)"
| table transporttype transportcount

This performs stats first and then massages the aggregated data using eval as per our need. In your case eval runs on entire raw data.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

@ tamduong16, This has definitely been answered before. You will have to calculate percent in your query and then replace your Pie chart label to have Name as well as rounded off percent. Then you turn of the showPercent option since your Label itself will display the percent (without hover)

https://answers.splunk.com/answers/351010/how-to-round-a-percentage-value-in-a-pie-chart-to.html
Or
https://answers.splunk.com/answers/589417/how-to-round-the-decimal-percentage-in-a-piechart.html

Try the following search (it will have better performance than yours)

 index="monthlycdr"
| stats count as transportcount by "Transport Type"
| eval transporttype=replace('Transport Type',"\"","") 
| fields - "Transport Type"
| eval transporttype=case( match(transporttype, "voice_sip"), "Sip_voice",match(transporttype, "(?i)sIp"), "Sip", match(transporttype, "(?i)voice_H323"), "H323_voice",match(transporttype, "(?i)H323"), "H323", match(transporttype, "(?i)pstn"), "PSTN")
| eventstats sum(transportcount) as Total
| eval perc=round((transportcount/Total)*100,1)
| eval transporttype=transporttype." (".perc."%)"
| table transporttype transportcount

This performs stats first and then massages the aggregated data using eval as per our need. In your case eval runs on entire raw data.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

sgessati
Explorer

Although that does the job, since each label will be generated using the percentage attached to it, we can't use the charting.fieldColors option anymore.
Unless there's a way to use wildcards in the field name but I know this doesn't work as it is :
{"UP*":0x97D2B4,"DOWN*":0xf2963f}

@sgessati , you can use CSS Selector to apply color using [^UP] or [^DOWN]. If you can post a separate question with the series names you intend to use, community members would be able to assist with required CSS.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

sgessati
Explorer

@niketnilay , thanks. I almost never use CSS but I'll google CSS Selector.
My categories are "UP - {countResults}" and "DOWN - {countResults}". 🙂

0 Karma

On second thought, you can directly rely of charting.seriesColors as far as both DOWN and UP fields are present (i.e. they should show up as 0 instead of not being present in result at all).

Since DOWN comes before UP in alphabetical order, it will pick up the first series color and UP will pick second series color. Try the following instead of charting.fieldColors

    <option name="charting.seriesColors">["#d93f3c","#65a637"]</option>

Since CSS override is for SVG element even that would be depended on CSS override to be applied on series rather than field names (unless you use jQuery which will complicate things).
@sgessati Please try out and confirm.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Get Updates on the Splunk Community!

Routing Data to Different Splunk Indexes in the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...

Getting Started with AIOps: Event Correlation Basics and Alert Storm Detection in ...

Getting Started with AIOps:Event Correlation Basics and Alert Storm Detection in Splunk IT Service ...

Register to Attend BSides SPL 2022 - It's all Happening October 18!

Join like-minded individuals for technical sessions on everything Splunk!  This is a community-led and run ...