Splunk Search

How do I convert the format the of the timechart y-axis values to percent?

HattrickNZ
Motivator

I have a search that is a timechart and the y-axis is showing a min of 0 and a max of 1, with 0.25, 0.5, 0.75 in between. How do I convert this Y-axis values to show that the min is 0 and the max is 100, with 25, 50, 75 in between?

I tried creating a field and using that in the timechart:
eval c84162281_percent=c84162281*100

but it seems to be skewing the data.

Was also thinking of trying fieldformat but no joy.

0 Karma

markthompson
Builder

Correct answer by @stephanefotso

Alternatively, you could use the good ole' GUI and adjust the numbers on the Y axis. Click the Edit Panels and then Click the properties drop down -> Y Axis -> Min value and max value

0 Karma

stephanefotso
Motivator

Thansks Markthompson. Also do not forget to take a look at the problem you asked at the address bellow.
http://answers.splunk.com/answers/227198/use-rangemap-to-change-color-of-whole-panel.html#answer-228....

SGF
0 Karma

stephanefotso
Motivator

Hello! If i understand your problem, you just need to multiplie your y values by 100. Take this as a template, whith the chart command. Just test it, maybe it could help you.

index=_internal| eventstats count by sourcetype| eventstats sum(count) as total by sourcetype | eval percentage=round(count*100/total,1)*100|chart values(percentage) by _time|head 10
SGF
Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Dynamic formatting from XML events

This challenge was first posted on Slack #puzzles channelFor a previous puzzle, I needed a set of fixed-length ...

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  🚀 Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Stronger Security with Federated Search for S3, GCP SQL & Australian Threat ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...