Splunk Search

Is there a way to add percentage labels to a stacked bar chart in Splunk 6.1.2?

HattrickNZ
Motivator

I have the following search
...| eval limit4Graph=Limit-Usage | fields userLabel limit4Graph Usage percent
Note: Limit-Usage here is because I have to use a stacked chart to get what I want in the visualisation part

this give me stats like this

userLabel   limit4Graph     Usage   percent
PR  23478   54299   69.813698
AM  71864   17024   19.152192 

THis is the visualization i get to (this is a stacked chart)
Image and video hosting by TinyPic

But I would like to display the percentages as lables like below (excel example)
Image and video hosting by TinyPic

Can this be done? with simple xml or in the search or some other?
I would also like to be able to control the order of the x-axis.

0 Karma

HattrickNZ
Motivator

I have just got splunk on my machine. My indexing volume licence has expired but i can still do the below search.

And i hope to document my workings here.

I start with this search:
index=_internal sourcetype="splunk_web_access" | eval limit=if(user=="admin",15000,if(user=="-",1000,"NULL"))| stats count(uri) as Usage max(limit) as Limit by user | eval percent=Usage/Limit*100 | eval limit4Graph=Limit-Usage | fields user Usage limit4Graph percent

And this gives me a stats like this

user    Usage   limit4Graph     percent
-   404     596     40.400000
admin   11076   3924    73.840000 

Then I want to do a stacked chart in the visualisation tab and save it as a panel in a dashboard.

have just added a css file and a js file here C:\Apps\Splunk\etc\apps\search\appserver\static
the search directory is where I created the dashbaord.

Now the hard part want to be able to have the percentage values as labels over the graph, using ramdasprlink text link .....will see how we go

0 Karma

ramdaspr
Contributor

AFAIK not without accessing the JS. A possible solution is provided here

0 Karma
Get Updates on the Splunk Community!

Splunk at Cisco Live 2025: Learning, Innovation, and a Little Bit of Mr. Brightside

Pack your bags (and maybe your dancing shoes)—Cisco Live is heading to San Diego, June 8–12, 2025, and Splunk ...

Splunk App Dev Community Updates – What’s New and What’s Next

Welcome to your go-to roundup of everything happening in the Splunk App Dev Community! Whether you're building ...

The Latest Cisco Integrations With Splunk Platform!

Join us for an exciting tech talk where we’ll explore the latest integrations in Cisco + Splunk! We’ve ...