Splunk Search

Show the a particular percentage using Single Value

JRamirezEnosys
Explorer

Hello Splunkers,

I've been trying to show in a Single Value Visualization 3 different percentage values.

My search looks into a single field of Email Actioning called "Act" , they are Accepted (Acc), Rejected (Rej) and Bounced (Bnc)

Best I was able to do was

index=email_logs Dir=inbound | timechart span=1d count by Act | untable _time Act count | eventstats sum(count) as Total by _time | eval perc=round(count*100/Total,2) | table _time Act perc | xyseries _time Act perc 

Whenever I send it as a Single Value it will show the Highest Value, Accepted on this case, but I don't see a way to show the Rejected or Bounced as a separate Single Value representation.

Could I get some advice,

Thank you.

0 Karma
1 Solution

niketn
Legend

@JRamirezEnosys, you would need to use Post Processing as your base search is transforming results as Time Series trend of percent of Each category of Act.

On similar lines to your question, I have used run anywhere example based on Splunk's _internal index which has a field called log_level with three values INFO WARN ERROR. I have changed your query to use addtotals with row=t to get row-wise total and then used foreach command to perform similar eval for INFO ERROR and WARN fields and calculate the total. This search has been used as as base search and fields _time and ERROR are retained for Error Trend Single Value Panel and similarly for other to series.

alt text

Please find below the Run anywhere Simple XML Dashboard code for the attached screenshot.

<form>
  <label>Show Separate Series in Single Value</label>
  <fieldset submitButton="false"></fieldset>
  <row>
    <panel>
      <title>Base Search All Results (Displaying Only For Demo)</title>
      <input type="time" token="tokTime" searchWhenChanged="true">
        <label></label>
        <default>
          <earliest>-7d@h</earliest>
          <latest>now</latest>
        </default>
      </input>
      <table>
        <search id="baseAllLogLevelPercentWithTime">
          <query>index=_internal sourcetype=splunkd log_level=* 
| timechart span=1d count by log_level 
| addtotals row=t col=f 
| foreach "ERROR" "INFO" "WARN" 
    [| eval "<<FIELD>>"= round(('<<FIELD>>'/Total)*100,2) ]
| fields - Total</query>
          <earliest>$tokTime.earliest$</earliest>
          <latest>$tokTime.latest$</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="count">20</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">none</option>
        <option name="percentagesRow">false</option>
        <option name="refresh.display">progressbar</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
      </table>
    </panel>
  </row>
  <row>
    <panel>
      <single>
        <title>INFO % - Single Value Trend</title>
        <search base="baseAllLogLevelPercentWithTime">
          <query>| table _time INFO</query>
        </search>
        <option name="colorBy">value</option>
        <option name="colorMode">block</option>
        <option name="rangeColors">["0xd93f3c","0xf7bc38","0x65a637"]</option>
        <option name="rangeValues">[90,95]</option>
        <option name="unit">%</option>
        <option name="useColors">1</option>
        <option name="useThousandSeparators">0</option>
      </single>
      <single>
        <title>WARN % - Single Value Trend</title>
        <search base="baseAllLogLevelPercentWithTime">
          <query>| table _time WARN</query>
        </search>
        <option name="colorBy">value</option>
        <option name="colorMode">block</option>
        <option name="rangeColors">["0x65a637","0xf7bc38","0xd93f3c"]</option>
        <option name="rangeValues">[5,10]</option>
        <option name="unit">%</option>
        <option name="useColors">1</option>
        <option name="useThousandSeparators">0</option>
      </single>
      <single>
        <title>Error % - Single Value Trend</title>
        <search base="baseAllLogLevelPercentWithTime">
          <query>| table _time ERROR</query>
        </search>
        <option name="colorBy">value</option>
        <option name="colorMode">block</option>
        <option name="rangeColors">["0x65a637","0xf7bc38","0xd93f3c"]</option>
        <option name="rangeValues">[5,10]</option>
        <option name="unit">%</option>
        <option name="useColors">1</option>
        <option name="useThousandSeparators">0</option>
      </single>
    </panel>
  </row>
</form>
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

0 Karma

niketn
Legend

@JRamirezEnosys, you would need to use Post Processing as your base search is transforming results as Time Series trend of percent of Each category of Act.

On similar lines to your question, I have used run anywhere example based on Splunk's _internal index which has a field called log_level with three values INFO WARN ERROR. I have changed your query to use addtotals with row=t to get row-wise total and then used foreach command to perform similar eval for INFO ERROR and WARN fields and calculate the total. This search has been used as as base search and fields _time and ERROR are retained for Error Trend Single Value Panel and similarly for other to series.

alt text

Please find below the Run anywhere Simple XML Dashboard code for the attached screenshot.

<form>
  <label>Show Separate Series in Single Value</label>
  <fieldset submitButton="false"></fieldset>
  <row>
    <panel>
      <title>Base Search All Results (Displaying Only For Demo)</title>
      <input type="time" token="tokTime" searchWhenChanged="true">
        <label></label>
        <default>
          <earliest>-7d@h</earliest>
          <latest>now</latest>
        </default>
      </input>
      <table>
        <search id="baseAllLogLevelPercentWithTime">
          <query>index=_internal sourcetype=splunkd log_level=* 
| timechart span=1d count by log_level 
| addtotals row=t col=f 
| foreach "ERROR" "INFO" "WARN" 
    [| eval "<<FIELD>>"= round(('<<FIELD>>'/Total)*100,2) ]
| fields - Total</query>
          <earliest>$tokTime.earliest$</earliest>
          <latest>$tokTime.latest$</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="count">20</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">none</option>
        <option name="percentagesRow">false</option>
        <option name="refresh.display">progressbar</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
      </table>
    </panel>
  </row>
  <row>
    <panel>
      <single>
        <title>INFO % - Single Value Trend</title>
        <search base="baseAllLogLevelPercentWithTime">
          <query>| table _time INFO</query>
        </search>
        <option name="colorBy">value</option>
        <option name="colorMode">block</option>
        <option name="rangeColors">["0xd93f3c","0xf7bc38","0x65a637"]</option>
        <option name="rangeValues">[90,95]</option>
        <option name="unit">%</option>
        <option name="useColors">1</option>
        <option name="useThousandSeparators">0</option>
      </single>
      <single>
        <title>WARN % - Single Value Trend</title>
        <search base="baseAllLogLevelPercentWithTime">
          <query>| table _time WARN</query>
        </search>
        <option name="colorBy">value</option>
        <option name="colorMode">block</option>
        <option name="rangeColors">["0x65a637","0xf7bc38","0xd93f3c"]</option>
        <option name="rangeValues">[5,10]</option>
        <option name="unit">%</option>
        <option name="useColors">1</option>
        <option name="useThousandSeparators">0</option>
      </single>
      <single>
        <title>Error % - Single Value Trend</title>
        <search base="baseAllLogLevelPercentWithTime">
          <query>| table _time ERROR</query>
        </search>
        <option name="colorBy">value</option>
        <option name="colorMode">block</option>
        <option name="rangeColors">["0x65a637","0xf7bc38","0xd93f3c"]</option>
        <option name="rangeValues">[5,10]</option>
        <option name="unit">%</option>
        <option name="useColors">1</option>
        <option name="useThousandSeparators">0</option>
      </single>
    </panel>
  </row>
</form>
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

niketn
Legend

@JRamirezEnosys, just want to add that special characters < and > got escaped while posting on Splunk Answers. So you should use & lt; & lt;FIELD & gt; & gt; instead of <<FIELD>>

Refer to documentation for foreach command related details.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

FrankVl
Ultra Champion

I guess you have two options to achieve that:

  1. If you're on a recent version of Splunk (6.6.x or 7.x), you could use the Trellis layout, to split by Act and show multiple single value visualizations in 1 go.
  2. Create separate dashboard panels for each of the 3 data points.
0 Karma

JRamirezEnosys
Explorer

Thank you for your response FranKVI,

I am currently running on 6.5.2 which does not allow me to use Trellis.

I would go for 3 separate dashboard panels but how do I get the correct percentage to show on every search?

I need a Search String to find the percentage of Acc, Bnc and Rej separately, is this doable ?

0 Karma

FrankVl
Ultra Champion

I guess the following would work, based of your current query:

define this as base search:

index=email_logs Dir=inbound | timechart span=1d count by Act | untable _time Act count | eventstats sum(count) as Total by _time | eval perc=round(count*100/Total,2) 

panel search (example for Acc, use similar for the other 2):

| where Act = "Acc" | table _time,perc

But you might want to take a look at the solution suggested by @niketnilay for a slightly different approach.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...