Splunk Search

How to display a Total Users label within Title of Pie Chart?

justdan23
Path Finder

I have a Panel on my Dashboard with a Chart showing the users who use the system.

The Chart shows the first 11 Users, but there is one pie slice showing "Other" to contain the remaining.

I'm trying to modify the Source of a Chart/Panel to display a Label under the Title showing the Total Users.

I'm using the following to create my Chart against an IIS log:

index=_* OR index=* sourcetype=iis | eval UN=upper(UN) | rename UN as Username | stats count (Username) as Total by Username | eval Username=Username." (".Total.")"

Is there a way to display a Label of the count of unique Username values under the Title or somewhere on the Chart? I tried using "", but the documentation is scarce.

<done>
   <eval token="resultcount_tok">$job.resultCount$</eval>
</done>

Thoughts?

0 Karma
1 Solution

Sukisen1981
Champion

Built this on the default _audit index, so that you can use the xml as is, try this

<dashboard>
  <label>pie</label>

        <search>
          <query>index="_audit"
| stats dc(action) as Total by action
| eval action=action." (".Total.")"</query>
<done>
    <eval token="rslt">$job.resultCount$</eval>
 </done>
          <earliest>-60m@m</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>


  <row>
    <panel>
      <title>Title - $rslt$</title>
      <chart>
        <search>
          <query>index="_audit"
| stats count(action) as Total by action
| eval action=action." (".Total.")"</query>
          <earliest>-60m@m</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="charting.chart">pie</option>
        <option name="charting.drilldown">none</option>
      </chart>
    </panel>
  </row>
</dashboard>

View solution in original post

Sukisen1981
Champion

Built this on the default _audit index, so that you can use the xml as is, try this

<dashboard>
  <label>pie</label>

        <search>
          <query>index="_audit"
| stats dc(action) as Total by action
| eval action=action." (".Total.")"</query>
<done>
    <eval token="rslt">$job.resultCount$</eval>
 </done>
          <earliest>-60m@m</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>


  <row>
    <panel>
      <title>Title - $rslt$</title>
      <chart>
        <search>
          <query>index="_audit"
| stats count(action) as Total by action
| eval action=action." (".Total.")"</query>
          <earliest>-60m@m</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="charting.chart">pie</option>
        <option name="charting.drilldown">none</option>
      </chart>
    </panel>
  </row>
</dashboard>
Get Updates on the Splunk Community!

Introducing Splunk Enterprise 9.2

WATCH HERE! Watch this Tech Talk to learn about the latest features and enhancements shipped in the new Splunk ...

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

Routing logs with Splunk OTel Collector for Kubernetes

The Splunk Distribution of the OpenTelemetry (OTel) Collector is a product that provides a way to ingest ...