index=test pod=poddy1 "severity"="INFO" "message"="IamExample*"
| rex field=message "IamExample(?<total>).*"
| rex field=message ".*ACCOUNT<accountreg>.*):"
| rex field=message ".*Login(?<login>.*)"
| rex field=message ".*Profile(?<profile>"
| rex field=message ".*Card(?<card>)"
| rex field=message ".*Online(?<online>) "
| stats count(total) as "Total" count(accountreg) as "Account" count(login) as "Login" count(profile) as "Profile" count(card) as "Card" count(online) as "Online "
Choosing a bar chart to display has "Total" show on the left hand side is there a way remove it?
also hovering over the chart its showing the count
is there a way to make it display like this example below?
field, count , percentage we want to divide Account , Login , Profile, Online it by Total that we have above
The Total on the y-axis comes from the first column listed in your results, so replace that with a column with a space for a name
| rex field=message "IamExample(?<total>).*"
| rex field=message ".*ACCOUNT(?<accountreg>.*):"
| rex field=message ".*Login(?<login>.*)"
| rex field=message ".*Profile(?<profile>)"
| rex field=message ".*Card(?<card>)"
| rex field=message ".*Online(?<online>) "
| stats count(total) as "_Total" count(accountreg) as "Account" count(login) as "Login" count(profile) as "Profile" count(card) as "Card" count(online) as "Online"
| foreach *
[| eval name="<<FIELD>>: ".round(100*<<FIELD>>/_Total, 2)."%"
| eval {name} = <<FIELD>>]
| table " " Account:* Login:* Profile:* Card:* Online:*
The Total on the y-axis comes from the first column listed in your results, so replace that with a column with a space for a name
| rex field=message "IamExample(?<total>).*"
| rex field=message ".*ACCOUNT(?<accountreg>.*):"
| rex field=message ".*Login(?<login>.*)"
| rex field=message ".*Profile(?<profile>)"
| rex field=message ".*Card(?<card>)"
| rex field=message ".*Online(?<online>) "
| stats count(total) as "_Total" count(accountreg) as "Account" count(login) as "Login" count(profile) as "Profile" count(card) as "Card" count(online) as "Online"
| foreach *
[| eval name="<<FIELD>>: ".round(100*<<FIELD>>/_Total, 2)."%"
| eval {name} = <<FIELD>>]
| table " " Account:* Login:* Profile:* Card:* Online:*