Dashboards & Visualizations

How to calculate the percentage in piechart with the field count?

jerrytao
New Member

My index is as below:
index | stats count by c4rupgrd-sourceVersion c4rupgrd-targetVersion

alt text

I want the percentage is calculated by count in pie chart.

Tags (1)
0 Karma
1 Solution

kamlesh_vaghela
SplunkTrust
SplunkTrust

@jerrytao

Your search producing 3 columns & in Pie Chart If the search generates a table with more than two columns, the extra columns are ignored.. Check https://docs.splunk.com/Documentation/SplunkCloud/7.2.6/Viz/PieChart#Data_formatting

If you observed in your existing pie chart count field is totally ignored which is important for you.

If it's important to display both 'c4rupgrd-sourceVersion&c4rupgrd-targetVersion` values in Pie chart then I suggest combining the value of both the fields and use it. Please check below SPL for same

YOUR_SEARCH | eval c4rupgrd-sourceVersion_c4rupgrd-targetVersion = tostring('c4rupgrd-sourceVersion')."-".tostring('c4rupgrd-targetVersion') | table c4rupgrd-sourceVersion_c4rupgrd-targetVersion count

My Sample search:

| makeresults | eval c4rupgrd-sourceVersion=2018,c4rupgrd-targetVersion=2019,count=11 | append [ | makeresults | eval c4rupgrd-sourceVersion=2018,c4rupgrd-targetVersion=2020,count=1] | append [ | makeresults | eval c4rupgrd-sourceVersion=2010,c4rupgrd-targetVersion=2020,count=3] | eval c4rupgrd-sourceVersion_c4rupgrd-targetVersion = tostring('c4rupgrd-sourceVersion')."-".tostring('c4rupgrd-targetVersion') | table c4rupgrd-sourceVersion_c4rupgrd-targetVersion count

Thanks

View solution in original post

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@jerrytao

Your search producing 3 columns & in Pie Chart If the search generates a table with more than two columns, the extra columns are ignored.. Check https://docs.splunk.com/Documentation/SplunkCloud/7.2.6/Viz/PieChart#Data_formatting

If you observed in your existing pie chart count field is totally ignored which is important for you.

If it's important to display both 'c4rupgrd-sourceVersion&c4rupgrd-targetVersion` values in Pie chart then I suggest combining the value of both the fields and use it. Please check below SPL for same

YOUR_SEARCH | eval c4rupgrd-sourceVersion_c4rupgrd-targetVersion = tostring('c4rupgrd-sourceVersion')."-".tostring('c4rupgrd-targetVersion') | table c4rupgrd-sourceVersion_c4rupgrd-targetVersion count

My Sample search:

| makeresults | eval c4rupgrd-sourceVersion=2018,c4rupgrd-targetVersion=2019,count=11 | append [ | makeresults | eval c4rupgrd-sourceVersion=2018,c4rupgrd-targetVersion=2020,count=1] | append [ | makeresults | eval c4rupgrd-sourceVersion=2010,c4rupgrd-targetVersion=2020,count=3] | eval c4rupgrd-sourceVersion_c4rupgrd-targetVersion = tostring('c4rupgrd-sourceVersion')."-".tostring('c4rupgrd-targetVersion') | table c4rupgrd-sourceVersion_c4rupgrd-targetVersion count

Thanks

0 Karma

jerrytao
New Member

@kamlesh_vaghela , it works as expected. I really appreciate your help!

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

Glad to help you @jerrytao

Happy Splunking

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...