Splunk Search

Is there a way to add percentage labels to a stacked bar chart in Splunk 6.1.2?

HattrickNZ
Motivator

I have the following search
...| eval limit4Graph=Limit-Usage | fields userLabel limit4Graph Usage percent
Note: Limit-Usage here is because I have to use a stacked chart to get what I want in the visualisation part

this give me stats like this

userLabel   limit4Graph     Usage   percent
PR  23478   54299   69.813698
AM  71864   17024   19.152192 

THis is the visualization i get to (this is a stacked chart)
Image and video hosting by TinyPic

But I would like to display the percentages as lables like below (excel example)
Image and video hosting by TinyPic

Can this be done? with simple xml or in the search or some other?
I would also like to be able to control the order of the x-axis.

0 Karma

HattrickNZ
Motivator

I have just got splunk on my machine. My indexing volume licence has expired but i can still do the below search.

And i hope to document my workings here.

I start with this search:
index=_internal sourcetype="splunk_web_access" | eval limit=if(user=="admin",15000,if(user=="-",1000,"NULL"))| stats count(uri) as Usage max(limit) as Limit by user | eval percent=Usage/Limit*100 | eval limit4Graph=Limit-Usage | fields user Usage limit4Graph percent

And this gives me a stats like this

user    Usage   limit4Graph     percent
-   404     596     40.400000
admin   11076   3924    73.840000 

Then I want to do a stacked chart in the visualisation tab and save it as a panel in a dashboard.

have just added a css file and a js file here C:\Apps\Splunk\etc\apps\search\appserver\static
the search directory is where I created the dashbaord.

Now the hard part want to be able to have the percentage values as labels over the graph, using ramdasprlink text link .....will see how we go

0 Karma

ramdaspr
Contributor

AFAIK not without accessing the JS. A possible solution is provided here

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...