Splunk Search

How do I convert the format the of the timechart y-axis values to percent?

HattrickNZ
Motivator

I have a search that is a timechart and the y-axis is showing a min of 0 and a max of 1, with 0.25, 0.5, 0.75 in between. How do I convert this Y-axis values to show that the min is 0 and the max is 100, with 25, 50, 75 in between?

I tried creating a field and using that in the timechart:
eval c84162281_percent=c84162281*100

but it seems to be skewing the data.

Was also thinking of trying fieldformat but no joy.

0 Karma

markthompson
Builder

Correct answer by @stephanefotso

Alternatively, you could use the good ole' GUI and adjust the numbers on the Y axis. Click the Edit Panels and then Click the properties drop down -> Y Axis -> Min value and max value

0 Karma

stephanefotso
Motivator

Thansks Markthompson. Also do not forget to take a look at the problem you asked at the address bellow.
http://answers.splunk.com/answers/227198/use-rangemap-to-change-color-of-whole-panel.html#answer-228....

SGF
0 Karma

stephanefotso
Motivator

Hello! If i understand your problem, you just need to multiplie your y values by 100. Take this as a template, whith the chart command. Just test it, maybe it could help you.

index=_internal| eventstats count by sourcetype| eventstats sum(count) as total by sourcetype | eval percentage=round(count*100/total,1)*100|chart values(percentage) by _time|head 10
SGF
Get Updates on the Splunk Community!

AppDynamics Summer Webinars

This summer, our mighty AppDynamics team is cooking up some delicious content on YouTube Live to satiate your ...

SOCin’ it to you at Splunk University

Splunk University is expanding its instructor-led learning portfolio with dedicated Security tracks at .conf25 ...

Credit Card Data Protection & PCI Compliance with Splunk Edge Processor

Organizations handling credit card transactions know that PCI DSS compliance is both critical and complex. The ...