How to display percentage values in the Y-axis?

[muralisushma7]

Hi,

As seen in the above image, you can see that visualization chart displays the top values of the field: Source Address.
X-axis displays the source address and Y-axis the count. I also need to include the percent value which is seen in the table( grayed out in the image) in the chart. How can I do that? Main aim is to derive the source address vs percentage use.
Kindly help me on this quickly.

Thanks & Regards,
Sushma.

[ehollima]

We need better badges in Answers....there are some really good "answers" here that I don't have the option to give proper credit too.

[niketn]

@ehollima, thanks for the kind words. I am glad that you found the answer useful. You are right that the Splunk Answers community is full of amazing answer and wisdom 🙂 I also get to learn a lot every day by being active on the community.

For the answers/comments that you like/find useful here, you can definitely up-vote then using the Up Arrow which displays on hovering over the comments or shows up next to Answers.

Following are the Badges that are applicable on Splunk Questions and Answers and get automatically applied based on conditions/popularity of the questions/answers 🙂

Splunk Community moderators publish Splunk Smart Answers monthly to showcase three of the selected answers every month to benefit the readers. Here is the 87th Smart Answers published in May 2018.

[muralisushma7]

Hi,

You are right. I too agree that there are really good answers. As I am new to this, I am not sure how to give badges to answers. Could you please let me know.

Regards,
Sushma.

[niketn]

@muralisushma7. When you hover over a comment you will see Up Arrow ^ which says Click to Up Vote. As there are several approaches in comments, for all the comments you can up vote using the same icon. Up Vote icons are always present next to answers.

[niketn]

@muralisushma7,

Please try the following run anywhere dashboard. It two options to present Real-time top 10 stats i.e. through Bar Chart and Status Indicator Custom Visualization. Real-time stats is showing just Top 10 Stats and Percent (No Time breakdown as time window is anyways rolling time bucket)

Below the same you can use historical 7 Days data as shared previously. I have added a 10 minute refresh for the Trellis Layout.

Please find below the Simple XML Dashboard Code.

<form>
  <label>Timechart with Volume and Percent with Trellis</label>
  <fieldset submitButton="false"></fieldset>
  <row>
    <panel>
      <title>Real Time 1 minute window</title>
      <input type="time" token="tokRealTime" searchWhenChanged="true">
        <label>Select Real Time Window</label>
        <default>
          <earliest>rt-1m</earliest>
          <latest>rt</latest>
        </default>
      </input>
    </panel>
  </row>
  <row>
    <panel>
      <chart>
        <title>Real-Time Top 10 Bar Chart</title>
        <search id="baseRealTimeSplunkdErrorSearch">
          <query>index=_internal sourcetype=splunkd log_level="INFO" 
| top 10 component
| eval "Error%"=round(percent,1)
| fields - percent
| rename count as Error
| stats last(Error) as Error last("Error%") as "Error%" by component</query>
          <earliest>$tokRealTime.earliest$</earliest>
          <latest>$tokRealTime.latest$</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
        <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
        <option name="charting.axisTitleX.visibility">visible</option>
        <option name="charting.axisTitleY.visibility">visible</option>
        <option name="charting.axisTitleY2.visibility">visible</option>
        <option name="charting.axisX.abbreviation">none</option>
        <option name="charting.axisX.scale">linear</option>
        <option name="charting.axisY.abbreviation">none</option>
        <option name="charting.axisY.scale">linear</option>
        <option name="charting.axisY2.abbreviation">none</option>
        <option name="charting.axisY2.enabled">1</option>
        <option name="charting.axisY2.scale">inherit</option>
        <option name="charting.chart">bar</option>
        <option name="charting.chart.bubbleMaximumSize">50</option>
        <option name="charting.chart.bubbleMinimumSize">10</option>
        <option name="charting.chart.bubbleSizeBy">area</option>
        <option name="charting.chart.nullValueMode">gaps</option>
        <option name="charting.chart.overlayFields">Error%</option>
        <option name="charting.chart.showDataLabels">all</option>
        <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
        <option name="charting.chart.stackMode">default</option>
        <option name="charting.chart.style">shiny</option>
        <option name="charting.drilldown">none</option>
        <option name="charting.layout.splitSeries">0</option>
        <option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
        <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
        <option name="charting.legend.mode">standard</option>
        <option name="charting.legend.placement">right</option>
        <option name="charting.lineWidth">2</option>
        <option name="refresh.display">progressbar</option>
        <option name="trellis.enabled">0</option>
        <option name="trellis.scales.shared">0</option>
        <option name="trellis.size">medium</option>
        <option name="trellis.splitBy">component</option>
      </chart>
    </panel>
    <panel>
      <viz type="status_indicator_app.status_indicator">
        <title>Real-Time Top 10 Status Indicator</title>
        <search base="baseRealTimeSplunkdErrorSearch">
          <query>| eval Error="Error: ".Error." (".'Error%'."%)"
| stats last(Error) as Error by component</query>
        </search>
        <option name="drilldown">none</option>
        <option name="refresh.display">progressbar</option>
        <option name="status_indicator_app.status_indicator.colorBy">static_color</option>
        <option name="status_indicator_app.status_indicator.fillTarget">text</option>
        <option name="status_indicator_app.status_indicator.fixIcon">warning</option>
        <option name="status_indicator_app.status_indicator.icon">fix_icon</option>
        <option name="status_indicator_app.status_indicator.precision">0</option>
        <option name="status_indicator_app.status_indicator.showOption">3</option>
        <option name="status_indicator_app.status_indicator.staticColor">#555</option>
        <option name="status_indicator_app.status_indicator.useColors">true</option>
        <option name="status_indicator_app.status_indicator.useThousandSeparator">true</option>
        <option name="trellis.enabled">1</option>
      </viz>
    </panel>
  </row>
  <row>
    <panel>
      <input type="time" token="tokTime" searchWhenChanged="true">
        <label></label>
        <default>
          <earliest>-7d@h</earliest>
          <latest>now</latest>
        </default>
      </input>
      <chart>
        <title>Daily Top 10 Errors by Component (Refreshes Every 10 minute)</title>
        <search>
          <query>index=_internal sourcetype=splunkd log_level=INFO
 | bin _time span=1d
 | stats count as Error by component _time
 | eventstats sum(Error) as Total by _time
 | eval "Error%"=round((Error/Total)*100,2)
 | fields - Total
 | sort - _time Error
 | streamstats count as sno by _time
 | search sno<=10
 | fields - sno
 | eval _time=strftime(_time,"%Y/%m/%d")
 | rename _time as Time
 | stats last(Error) as Error last("Error%") as "Error%" by Time component
 | sort - Error</query>
          <earliest>$tokTime.earliest$</earliest>
          <latest>$tokTime.latest$</latest>
          <sampleRatio>1</sampleRatio>
          <refresh>10m</refresh>
          <refreshType>delay</refreshType>
        </search>
        <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisMiddle</option>
        <option name="charting.axisLabelsX.majorLabelStyle.rotation">-45</option>
        <option name="charting.axisTitleX.visibility">visible</option>
        <option name="charting.axisTitleY.visibility">visible</option>
        <option name="charting.axisTitleY2.visibility">visible</option>
        <option name="charting.axisX.abbreviation">none</option>
        <option name="charting.axisX.scale">linear</option>
        <option name="charting.axisY.abbreviation">none</option>
        <option name="charting.axisY.scale">linear</option>
        <option name="charting.axisY2.abbreviation">none</option>
        <option name="charting.axisY2.enabled">1</option>
        <option name="charting.axisY2.scale">inherit</option>
        <option name="charting.chart">column</option>
        <option name="charting.chart.bubbleMaximumSize">50</option>
        <option name="charting.chart.bubbleMinimumSize">10</option>
        <option name="charting.chart.bubbleSizeBy">area</option>
        <option name="charting.chart.nullValueMode">gaps</option>
        <option name="charting.chart.overlayFields">Error%</option>
        <option name="charting.chart.showDataLabels">none</option>
        <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
        <option name="charting.chart.stackMode">default</option>
        <option name="charting.chart.style">shiny</option>
        <option name="charting.drilldown">none</option>
        <option name="charting.layout.splitSeries">0</option>
        <option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
        <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
        <option name="charting.legend.mode">standard</option>
        <option name="charting.legend.placement">bottom</option>
        <option name="charting.lineWidth">2</option>
        <option name="height">250</option>
        <option name="refresh.display">progressbar</option>
        <option name="trellis.enabled">1</option>
        <option name="trellis.scales.shared">0</option>
        <option name="trellis.size">medium</option>
        <option name="trellis.splitBy">Time</option>
        <option name="height">600</option>
      </chart>
    </panel>
  </row>
</form>

[muralisushma7]

Hi,

I have gone through the above code and can see that you have created 2 different panels for real time and relative. It is really useful. I still think as why real time and relative cannot be included into a single panel itself. The panel which you created for historical data is really good, in the same panel itself why is that we cannot include the real time events? If that can be done, it would be really helpful in my scenario.

Thanks & Regards,
Sushma.

[niketn]

@muralisushma7 as explained earlier, real-time and historical search are different in behavior. Real-time searches are also expensive for Splunk infrastructure as they need to run constantly for selected time window. If you plan to merge the commands as real-time search it will be constantly running in background with last 7 days data. You would also need to read about and understand the difference between streaming and non-streaming commands as both will work differently with real-time searches.

Moreover, I think you had agreed in one of your previous comments to use two separate panels for Real-time and non real-time search. The top panel can be single value with last 1 minute time window and below can be as per query previously selected.

If this helps please up vote the comments.

[muralisushma7]

Hi,

Many thanks for all your guidance. Last help on this. For the real time query, i tweaked to make it suitable for our environment as below:

source="jnpr-syslog" policy_name=Internet_Lab_Policy_Gateway_Logging source
| top 20 source_address
| eval "%New_Connection"=round(percent,1)
| fields - percent
| rename count as New_Connection
| stats last(New_Connection) as New_Connection last("%New_Connection") as "%New_Connection" by source_address

Either I am missing something or something that needs to be modified, because the dashboard is still waiting for the input.

Thanks & Regards,
Sushma.

[niketn · Accepted solution]

@muralisushma7, please try the following search. If you are on Splunk 6.6 or higher you can use Trellis Layout to break the timechart by Time.

 source="jnpr-syslog" policy_name=Internet_Lab_Policy_Gateway_Logging source 
| bin _time span=1d
| stats count as Count by source_address _time
| eventstats sum(Count) as Total by _time
| eval "Count%"=round((Count/Total)*100,2)
| fields - Total
| sort - _time Count
| streamstats count as sno by _time
| search sno<=20
| fields - sno
| eval _time=strftime(_time,"%Y/%m/%d")
| rename _time as Time
| stats last(Count) as Count last("Count%") as "Count%" by Time source_address
| sort - Count

Following is a run anywhere dashboard example based on Splunk's _internal index

Please find the Simple XML dashboard code for example above:

<form>
  <label>Timechart with Volume and Percent with Trellis</label>
  <fieldset submitButton="false"></fieldset>
  <row>
    <panel>
      <input type="time" token="tokTime" searchWhenChanged="true">
        <label></label>
        <default>
          <earliest>-7d@h</earliest>
          <latest>now</latest>
        </default>
      </input>
      <chart>
        <title>Daily Top 10 Errors by Component</title>
        <search>
          <query>index=_internal sourcetype=splunkd log_level!=INFO
| bin _time span=1d
| stats count as Error by component _time
| eventstats sum(Error) as Total by _time
| eval "Error%"=round((Error/Total)*100,2)
| fields - Total
| sort - _time Error
| streamstats count as sno by _time
| search sno<=10
| fields - sno
| eval _time=strftime(_time,"%Y/%m/%d")
| rename _time as Time
| stats last(Error) as Error last("Error%") as "Error%" by Time component
| sort - Error</query>
          <earliest>$tokTime.earliest$</earliest>
          <latest>$tokTime.latest$</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisMiddle</option>
        <option name="charting.axisLabelsX.majorLabelStyle.rotation">-45</option>
        <option name="charting.axisTitleX.visibility">visible</option>
        <option name="charting.axisTitleY.visibility">visible</option>
        <option name="charting.axisTitleY2.visibility">visible</option>
        <option name="charting.axisX.abbreviation">none</option>
        <option name="charting.axisX.scale">linear</option>
        <option name="charting.axisY.abbreviation">none</option>
        <option name="charting.axisY.scale">linear</option>
        <option name="charting.axisY2.abbreviation">none</option>
        <option name="charting.axisY2.enabled">1</option>
        <option name="charting.axisY2.scale">inherit</option>
        <option name="charting.chart">column</option>
        <option name="charting.chart.bubbleMaximumSize">50</option>
        <option name="charting.chart.bubbleMinimumSize">10</option>
        <option name="charting.chart.bubbleSizeBy">area</option>
        <option name="charting.chart.nullValueMode">gaps</option>
        <option name="charting.chart.overlayFields">Error%</option>
        <option name="charting.chart.showDataLabels">none</option>
        <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
        <option name="charting.chart.stackMode">default</option>
        <option name="charting.chart.style">shiny</option>
        <option name="charting.drilldown">none</option>
        <option name="charting.layout.splitSeries">0</option>
        <option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
        <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
        <option name="charting.legend.mode">standard</option>
        <option name="charting.legend.placement">bottom</option>
        <option name="charting.lineWidth">2</option>
        <option name="height">600</option>
        <option name="refresh.display">progressbar</option>
        <option name="trellis.enabled">1</option>
        <option name="trellis.scales.shared">0</option>
        <option name="trellis.size">medium</option>
        <option name="trellis.splitBy">Time</option>
      </chart>
    </panel>
  </row>
</form>

[muralisushma7]

Hi,

We are using Splunk 6.5.1 version, so kindly let me know how to achieve the above dashboard.

[muralisushma7]

Thanks Niketnilay for the code. I manipulated the above code to suit our environment and it is working as required. One small information I would like to know, how to bypass the SPLUNK login configured using LDAP authentication.

[niketn]

@muralisushma7 is there a single Query in your Dashboard or multiple? If you create a Scheduled Report, you can embed the same in an HTML page and share HTML page with users. Other option would be PDF delivery of the report/dashboard (however, many visualizations may not work correctly with scheduled PDF delivery).

There would be an option to embed dashboard to your own webpage as well. However, it would not be a recommended approach: https://answers.splunk.com/answers/582632/how-do-you-use-custom-xml-in-reports-from-dashboar.html

[muralisushma7]

Hi,

Along with that can you also let me know, how to include Date in the graph above. Since I created this as dashboard, go to edit dashboard and selected add input as Time range, but I dont think it is giving me the correct output.

Can you guide me on this?

Thanks & Regards,
Sushma.

[niketn]

@muralisushma7, first off instead of posting Answer, try to add a comment under previous answer/comment so that every post does not go for moderation.

Seems like you have taken right steps to add Time input. Hopefully you have added the time input tokens to your search query as well. Close out the browser and reload the dashboard in case you have changed the Time Input token name as by default it picks up tokens field1.earliest and field1.latest

Refer to documentation for details.
https://docs.splunk.com/Documentation/Splunk/latest/Viz/Buildandeditforms#Form_with_time_inputs_exam...

[muralisushma7]

Hi,

I have two queries as below:

source="jnpr-syslog" policy_name=Internet_Lab_Policy_Gateway_Logging source | top limit=20 source_address | chart sum(count) as Total last(percent) as percent by source_address | sort - Total

eval date_wday=strftime(_time,"%u") | timechart span=1d count by source_address

How to combine both into single query.

My final requirement is to display the source address versus max percentage use for a given day.

Please help.

Regards,
Sushma.

[muralisushma7]

I am waiting for this.

Can you please let me know how to proceed.

Thanks & Regards,
Sushma.

[niketn]

@muralisushma7 please see attached an example based on Trellis Layout (will work if you are on Splunk 6.6 or higher).

Please try out and confirm!

[muralisushma7]

My search query is: source="jnpr-syslog" policy_name=Internet_Lab_Policy_Gateway_Logging source | top limit=20 source_address | chart sum(count) as Total last(percent) as percent by source_address | sort - Total | timechart count by percent.

Something is wrong here?

What i just need is the source address vs percentage on a given day.

[muralisushma7]

Hi,

Thanks for the query. Just to re-confirm, this query produces first 20 source addresses with highest percentage use isn't it? Moreover if I save this visualization chart as dashboard, it would be a dynamic one right( the first 20 source addresses with the corresponding % keeps on updating as and when) or do we need to some setting to be done?

Regards,
Sushma.

[niketn]

@muralisushma7, Yes basically the top command gets both count and percent. You can use any appropriate method to get the same for each source_address as there will be only row per source_address. So you can also use the following:

|  top 20 source_address
|  chart last(count) as Total last(percent) as percent by source_address
|  sort - Total

Please try out and confirm. If it works don't forget to accept/up vote the answer/comment.