Splunk Search

How can I add the total row count somewhere on the pie chart?

brian661
New Member

I have a search string for creating a pie chart
If I want to show the total rows on the top or anywhere of the chart.
how can I do it?

myLogSearch| stats count(eval(like(subject,"Maths"))) as Math_total_score, count(eval(like(subject, "English") AND attended == true ))| transpose
Tags (4)
0 Karma
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

Take a second panel - e.g. single value or HTML - and display the total there.

View solution in original post

niketn
Legend

Refer to my answer on putting label in Pie Chart. You would need to use eventstats to get the Total and then based on each slice's value compute the percent. Finally, you need to change the label name itself to show Total and Percent. This way you labels will show both without hovering over it.

https://answers.splunk.com/answers/351010/how-to-round-a-percentage-value-in-a-pie-chart-to.html#ans...

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Take a second panel - e.g. single value or HTML - and display the total there.

martin_mueller
SplunkTrust
SplunkTrust

Something like this pseudo-SimpleXML:

<dashboard>
  <row>
    <panel>
      <chart>
        <search id="pie">your regular pie search</search>
        your regular pie chart
      </chart>
    </panel>
  </row>
  <row>
    <panel>
      <single>
        <search base="pie">stats sum('row 1') as count</search>
      </single>
    <panel>
  </row>
</dashboard>
0 Karma

brian661
New Member

Do you mean just add a second panel with a search string for getting the total count? this is my current solution but just want to search for a advance solution.

0 Karma

rjthibod
Champion

Yes, that is the only solution that doesn't involve doing in JS. If it were me, I would use a second post-processing search to sum the sow 1 field after transpose, and then use the search event handler <done> to set a token value that contains the sum value. Then you can display that total in an HTML string atop of the Pie Chart panel. Otherwise, you can put the results of the second post-processing search into a single value panel like @martin_mueller suggested.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...