Splunk Search

How to show a percentage of the total events in a pie chart

Svill321
Path Finder

I feel dumb for asking something so simple, but I can't make this work. I'm trying to show a percentage I've calculated as a piechart:

| dbxquery query=stuff | stats count(eval(Start_Date_Time > 
End_Date_Time)) as breach count as total | eval percent=breach/total*100 | eval total=total/total*100 | chart max(percent) over total

As you can see, I calculated both the percent of events where the start time is greater than the end time, and the corresponding total, which, of course is 100%. All I need to do now is show it in a pie chart. I calculated the total percent due to the chart only showing a solid block of color for my percent. I was hoping that I could use it to show the percentage correctly, but I was wrong on that.

Also, I can't use top; I need to consider all the events, not just the top values.

0 Karma
1 Solution

woodcock
Esteemed Legend

Try this:

| dbxquery query=stuff 
| stats count(eval(Start_Date_Time > End_Date_Time)) as breach count as total
| eval breach=100*breach/total
| eval non-breach=100-breach
| transpose

View solution in original post

woodcock
Esteemed Legend

Try this:

| dbxquery query=stuff 
| stats count(eval(Start_Date_Time > End_Date_Time)) as breach count as total
| eval breach=100*breach/total
| eval non-breach=100-breach
| transpose

Svill321
Path Finder

This actually works very well. I just made a minor modification to get rid of the total field.

 | dbxquery query=stuff 
 | stats count(eval(Start_Date_Time > End_Date_Time)) as breach count as total
 | eval breach=100*breach/total
 | eval non-breach=100-breach
 | transpose

Now I'm just going to figure out how to show count with it. Thank you

0 Karma

woodcock
Esteemed Legend

If you don't do the percentage and just show raw values for breach and non-breach it should show both count and percent.

0 Karma

jkat54
SplunkTrust
SplunkTrust

Pie chart requires a by-clause

Try

| chart max(percent) by something

You don't even have to calculate the percent

This might work:

| stats max(breach) by _time

You need your data to end up with multiple rows and more than one column like this:

hostname,breach_count
HostA,25
HostB,75

Then | stats max(breach_count) by hostname
would have a pie chart where the total is 100 and HostA would be 25% and HostB would be 75%.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...