I have the following search
...| eval limit4Graph=Limit-Usage | fields userLabel limit4Graph Usage percent
Note: Limit-Usage here is because I have to use a stacked chart to get what I want in the visualisation part
this give me stats like this
userLabel limit4Graph Usage percent
PR 23478 54299 69.813698
AM 71864 17024 19.152192
THis is the visualization i get to (this is a stacked chart)
But I would like to display the percentages as lables like below (excel example)
Can this be done? with simple xml or in the search or some other?
I would also like to be able to control the order of the x-axis.
I have just got splunk on my machine. My indexing volume
licence has expired but i can still do the below search.
And i hope to document my workings here.
I start with this search:
index=_internal sourcetype="splunk_web_access" | eval limit=if(user=="admin",15000,if(user=="-",1000,"NULL"))| stats count(uri) as Usage max(limit) as Limit by user | eval percent=Usage/Limit*100 | eval limit4Graph=Limit-Usage | fields user Usage limit4Graph percent
And this gives me a stats like this
user Usage limit4Graph percent
- 404 596 40.400000
admin 11076 3924 73.840000
Then I want to do a stacked chart in the visualisation tab and save it as a panel in a dashboard.
have just added a css file and a js file here C:\Apps\Splunk\etc\apps\search\appserver\static
the search directory is where I created the dashbaord.
Now the hard part want to be able to have the percentage values as labels over the graph, using ramdaspr
link text link .....will see how we go
AFAIK not without accessing the JS. A possible solution is provided here