Splunk Search

Pie chart round default percentage

tamduong16
Contributor

I have the following search:

index="monthlycdr" | eval "transporttype"=replace('Transport Type',"\"","") | eval "tt"=case( match(transporttype, "(?i)voice_sip"), "Sip_voice",match(transporttype, "(?i)sIp"), "Sip", match(transporttype, "(?i)voice_H323"), "H323_voice",match(transporttype, "(?i)H323"), "H323", match(transporttype, "(?i)pstn"), "PSTN") | stats count by tt

with the option:

alt text

And this is my result picture:

alt text

I know by default splunk has this percentage to 3 decimals. But is there anyway I could round it to 1? If not, how can I calculate it manually in my search base on the search that I have now? I've tried to calculate the percentage from my search but due to the case statement, I can't figure out a way to calculate the percentage value.

Thanks!

0 Karma
1 Solution

niketn
Legend

@ tamduong16, This has definitely been answered before. You will have to calculate percent in your query and then replace your Pie chart label to have Name as well as rounded off percent. Then you turn of the showPercent option since your Label itself will display the percent (without hover)

https://answers.splunk.com/answers/351010/how-to-round-a-percentage-value-in-a-pie-chart-to.html
Or
https://answers.splunk.com/answers/589417/how-to-round-the-decimal-percentage-in-a-piechart.html

Try the following search (it will have better performance than yours)

 index="monthlycdr"
| stats count as transportcount by "Transport Type"
| eval transporttype=replace('Transport Type',"\"","") 
| fields - "Transport Type"
| eval transporttype=case( match(transporttype, "voice_sip"), "Sip_voice",match(transporttype, "(?i)sIp"), "Sip", match(transporttype, "(?i)voice_H323"), "H323_voice",match(transporttype, "(?i)H323"), "H323", match(transporttype, "(?i)pstn"), "PSTN")
| eventstats sum(transportcount) as Total
| eval perc=round((transportcount/Total)*100,1)
| eval transporttype=transporttype." (".perc."%)"
| table transporttype transportcount

This performs stats first and then massages the aggregated data using eval as per our need. In your case eval runs on entire raw data.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

niketn
Legend

@ tamduong16, This has definitely been answered before. You will have to calculate percent in your query and then replace your Pie chart label to have Name as well as rounded off percent. Then you turn of the showPercent option since your Label itself will display the percent (without hover)

https://answers.splunk.com/answers/351010/how-to-round-a-percentage-value-in-a-pie-chart-to.html
Or
https://answers.splunk.com/answers/589417/how-to-round-the-decimal-percentage-in-a-piechart.html

Try the following search (it will have better performance than yours)

 index="monthlycdr"
| stats count as transportcount by "Transport Type"
| eval transporttype=replace('Transport Type',"\"","") 
| fields - "Transport Type"
| eval transporttype=case( match(transporttype, "voice_sip"), "Sip_voice",match(transporttype, "(?i)sIp"), "Sip", match(transporttype, "(?i)voice_H323"), "H323_voice",match(transporttype, "(?i)H323"), "H323", match(transporttype, "(?i)pstn"), "PSTN")
| eventstats sum(transportcount) as Total
| eval perc=round((transportcount/Total)*100,1)
| eval transporttype=transporttype." (".perc."%)"
| table transporttype transportcount

This performs stats first and then massages the aggregated data using eval as per our need. In your case eval runs on entire raw data.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

sgessati
Explorer

Although that does the job, since each label will be generated using the percentage attached to it, we can't use the charting.fieldColors option anymore.
Unless there's a way to use wildcards in the field name but I know this doesn't work as it is :
{"UP*":0x97D2B4,"DOWN*":0xf2963f}

niketn
Legend

@sgessati , you can use CSS Selector to apply color using [^UP] or [^DOWN]. If you can post a separate question with the series names you intend to use, community members would be able to assist with required CSS.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

sgessati
Explorer

@niketnilay , thanks. I almost never use CSS but I'll google CSS Selector.
My categories are "UP - {countResults}" and "DOWN - {countResults}". 🙂

0 Karma

niketn
Legend

On second thought, you can directly rely of charting.seriesColors as far as both DOWN and UP fields are present (i.e. they should show up as 0 instead of not being present in result at all).

Since DOWN comes before UP in alphabetical order, it will pick up the first series color and UP will pick second series color. Try the following instead of charting.fieldColors

    <option name="charting.seriesColors">["#d93f3c","#65a637"]</option>

Since CSS override is for SVG element even that would be depended on CSS override to be applied on series rather than field names (unless you use jQuery which will complicate things).
@sgessati Please try out and confirm.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Get Updates on the Splunk Community!

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud  In today’s fast-paced digital ...

Observability protocols to know about

Observability protocols define the specifications or formats for collecting, encoding, transporting, and ...

Take Your Breath Away with Splunk Risk-Based Alerting (RBA)

WATCH NOW!The Splunk Guide to Risk-Based Alerting is here to empower your SOC like never before. Join Haylee ...