Splunk Search

Splunk bar chart how can i display percentage and total count

Cheng2Ready
Communicator
index=test   pod=poddy1 "severity"="INFO"    "message"="IamExample*"

| rex field=message "IamExample(?<total>).*"
| rex field=message ".*ACCOUNT<accountreg>.*):"
| rex field=message ".*Login(?<login>.*)"
| rex field=message ".*Profile(?<profile>"
| rex field=message ".*Card(?<card>)"
| rex field=message ".*Online(?<online>) "

| stats count(total) as "Total" count(accountreg) as "Account" count(login) as "Login" count(profile) as "Profile" count(card) as "Card" count(online) as "Online "


Choosing a bar chart to display has "Total" show on the left hand side is there a way remove it?

Cheng2Ready_1-1732903835512.png
also hovering over the chart its showing the count
is there a way to make it display like this example below?

field, count , percentage we want to divide Account , Login , Profile, Online it by Total that we have above 

Cheng2Ready_2-1732903909165.png

 

 

 

 




Labels (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

The Total on the y-axis comes from the first column listed in your results, so replace that with a column with a space for a name

| rex field=message "IamExample(?<total>).*"
| rex field=message ".*ACCOUNT(?<accountreg>.*):"
| rex field=message ".*Login(?<login>.*)"
| rex field=message ".*Profile(?<profile>)"
| rex field=message ".*Card(?<card>)"
| rex field=message ".*Online(?<online>) "

| stats count(total) as "_Total" count(accountreg) as "Account" count(login) as "Login" count(profile) as "Profile" count(card) as "Card" count(online) as "Online"
| foreach *
    [| eval name="<<FIELD>>: ".round(100*<<FIELD>>/_Total, 2)."%"
    | eval {name} = <<FIELD>>]
| table " " Account:* Login:* Profile:* Card:* Online:*

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust

The Total on the y-axis comes from the first column listed in your results, so replace that with a column with a space for a name

| rex field=message "IamExample(?<total>).*"
| rex field=message ".*ACCOUNT(?<accountreg>.*):"
| rex field=message ".*Login(?<login>.*)"
| rex field=message ".*Profile(?<profile>)"
| rex field=message ".*Card(?<card>)"
| rex field=message ".*Online(?<online>) "

| stats count(total) as "_Total" count(accountreg) as "Account" count(login) as "Login" count(profile) as "Profile" count(card) as "Card" count(online) as "Online"
| foreach *
    [| eval name="<<FIELD>>: ".round(100*<<FIELD>>/_Total, 2)."%"
    | eval {name} = <<FIELD>>]
| table " " Account:* Login:* Profile:* Card:* Online:*
Get Updates on the Splunk Community!

Data Management Digest – December 2025

Welcome to the December edition of Data Management Digest! As we continue our journey of data innovation, the ...

Index This | What is broken 80% of the time by February?

December 2025 Edition   Hayyy Splunk Education Enthusiasts and the Eternally Curious!    We’re back with this ...

Unlock Faster Time-to-Value on Edge and Ingest Processor with New SPL2 Pipeline ...

Hello Splunk Community,   We're thrilled to share an exciting update that will help you manage your data more ...