Splunk Search

Would like timechart (count) to show a legend with overall % next to each item

bhartmann
New Member

I've been looking at some similar questions .. (for instance, this showed how to have timechart display % each day instead of totals: https://answers.splunk.com/answers/180723/how-to-display-percentage-rather-than-count-of-a-f.html) (sorry if this doesn't show - i am new to the answers forum and it says I don't have enough karma yet to post links)

What we really want is for the timechart to show counts (the default), but to alter the legend if possible, so instead of the legend just mimicking the total for each day when you mouse-over a data point, the legend by default would show % of total data next to each item. (Ideally also it would be nice to have the legend sort so that the highest-percentage item would bubble to the top, etc., though from other posts it sounds like it is very difficult to deviate from alphabetic listing of items?).

for example, if my basic chart search starts with something like: index=hec earliest=-7d| timechart count by category
and it shows 5 category examples, and say the category named "Session" is most common at 60% (covering the 7d span), at minimum we would like to display something like "60.0%" next to "Session" in the legend, and even better if we can have "Session" be first item listed in the legend because it has the highest %.

If this is not practical within a single "chart" or report, perhaps we can turn off the legend and set up a dashboard with 2 searches of the same data next to each to simulate the same outcome?

I appreciate any advice on this. Thanks!

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...