Splunk Search

Splunk bar chart how can i display percentage and total count

Cheng2Ready
Path Finder
index=test   pod=poddy1 "severity"="INFO"    "message"="IamExample*"

| rex field=message "IamExample(?<total>).*"
| rex field=message ".*ACCOUNT<accountreg>.*):"
| rex field=message ".*Login(?<login>.*)"
| rex field=message ".*Profile(?<profile>"
| rex field=message ".*Card(?<card>)"
| rex field=message ".*Online(?<online>) "

| stats count(total) as "Total" count(accountreg) as "Account" count(login) as "Login" count(profile) as "Profile" count(card) as "Card" count(online) as "Online "


Choosing a bar chart to display has "Total" show on the left hand side is there a way remove it?

Cheng2Ready_1-1732903835512.png
also hovering over the chart its showing the count
is there a way to make it display like this example below?

field, count , percentage we want to divide Account , Login , Profile, Online it by Total that we have above 

Cheng2Ready_2-1732903909165.png

 

 

 

 




Labels (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

The Total on the y-axis comes from the first column listed in your results, so replace that with a column with a space for a name

| rex field=message "IamExample(?<total>).*"
| rex field=message ".*ACCOUNT(?<accountreg>.*):"
| rex field=message ".*Login(?<login>.*)"
| rex field=message ".*Profile(?<profile>)"
| rex field=message ".*Card(?<card>)"
| rex field=message ".*Online(?<online>) "

| stats count(total) as "_Total" count(accountreg) as "Account" count(login) as "Login" count(profile) as "Profile" count(card) as "Card" count(online) as "Online"
| foreach *
    [| eval name="<<FIELD>>: ".round(100*<<FIELD>>/_Total, 2)."%"
    | eval {name} = <<FIELD>>]
| table " " Account:* Login:* Profile:* Card:* Online:*

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust

The Total on the y-axis comes from the first column listed in your results, so replace that with a column with a space for a name

| rex field=message "IamExample(?<total>).*"
| rex field=message ".*ACCOUNT(?<accountreg>.*):"
| rex field=message ".*Login(?<login>.*)"
| rex field=message ".*Profile(?<profile>)"
| rex field=message ".*Card(?<card>)"
| rex field=message ".*Online(?<online>) "

| stats count(total) as "_Total" count(accountreg) as "Account" count(login) as "Login" count(profile) as "Profile" count(card) as "Card" count(online) as "Online"
| foreach *
    [| eval name="<<FIELD>>: ".round(100*<<FIELD>>/_Total, 2)."%"
    | eval {name} = <<FIELD>>]
| table " " Account:* Login:* Profile:* Card:* Online:*
Get Updates on the Splunk Community!

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud  In today’s fast-paced digital ...

Observability protocols to know about

Observability protocols define the specifications or formats for collecting, encoding, transporting, and ...

Take Your Breath Away with Splunk Risk-Based Alerting (RBA)

WATCH NOW!The Splunk Guide to Risk-Based Alerting is here to empower your SOC like never before. Join Haylee ...