Splunk Search

Show percent instead of count in top chart

Engager

I'm using the top command and wanted the generated chart to show the percent value for each of the items instead of the count. The documentation doesn't say how to do this and I couldn't find an answer by searching this forum, but I eventually figured out a way to do it which I'll post here as an answer in case others have the same need.

0 Karma
1 Solution

Legend

Use table to reorder the results. The graph results view seems to simply grab the first two fields in the generated table and then use the first field as its X axis and the second field for Y axis. So, the following will do the trick:

... | top field | table field percent

View solution in original post

0 Karma

Legend

Use table to reorder the results. The graph results view seems to simply grab the first two fields in the generated table and then use the first field as its X axis and the second field for Y axis. So, the following will do the trick:

... | top field | table field percent

View solution in original post

0 Karma

Engager

Thanks, that works too.

0 Karma

Legend

or just

... | top showcount=false fieldForTop

To show only the percent field. To show only the count field:

... | top showperc=false fieldForTop

Or you can always pipe to the fields command

... | top  fieldForTop | fields - count

... | top  fieldForTop | fields - percent

Engager

At least w/ Splunk 4.3.1, which we're using, doing the above doesn't work -- it shows an empty chart.

To be clear, I'm talking specifically about the Results Chart view of the top output, not the Table view for which your solution works.

0 Karma

Engager

Here's how to do it:

... | top showcount=false percentfield=count ...

This works because the chart is hardcoded to display the "count" value.

0 Karma