Splunk Search

How to display a Total Users label within Title of Pie Chart?

justdan23
Path Finder

I have a Panel on my Dashboard with a Chart showing the users who use the system.

The Chart shows the first 11 Users, but there is one pie slice showing "Other" to contain the remaining.

I'm trying to modify the Source of a Chart/Panel to display a Label under the Title showing the Total Users.

I'm using the following to create my Chart against an IIS log:

index=_* OR index=* sourcetype=iis | eval UN=upper(UN) | rename UN as Username | stats count (Username) as Total by Username | eval Username=Username." (".Total.")"

Is there a way to display a Label of the count of unique Username values under the Title or somewhere on the Chart? I tried using "", but the documentation is scarce.

<done>
   <eval token="resultcount_tok">$job.resultCount$</eval>
</done>

Thoughts?

0 Karma
1 Solution

Sukisen1981
Champion

Built this on the default _audit index, so that you can use the xml as is, try this

<dashboard>
  <label>pie</label>

        <search>
          <query>index="_audit"
| stats dc(action) as Total by action
| eval action=action." (".Total.")"</query>
<done>
    <eval token="rslt">$job.resultCount$</eval>
 </done>
          <earliest>-60m@m</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>


  <row>
    <panel>
      <title>Title - $rslt$</title>
      <chart>
        <search>
          <query>index="_audit"
| stats count(action) as Total by action
| eval action=action." (".Total.")"</query>
          <earliest>-60m@m</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="charting.chart">pie</option>
        <option name="charting.drilldown">none</option>
      </chart>
    </panel>
  </row>
</dashboard>

View solution in original post

Sukisen1981
Champion

Built this on the default _audit index, so that you can use the xml as is, try this

<dashboard>
  <label>pie</label>

        <search>
          <query>index="_audit"
| stats dc(action) as Total by action
| eval action=action." (".Total.")"</query>
<done>
    <eval token="rslt">$job.resultCount$</eval>
 </done>
          <earliest>-60m@m</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>


  <row>
    <panel>
      <title>Title - $rslt$</title>
      <chart>
        <search>
          <query>index="_audit"
| stats count(action) as Total by action
| eval action=action." (".Total.")"</query>
          <earliest>-60m@m</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="charting.chart">pie</option>
        <option name="charting.drilldown">none</option>
      </chart>
    </panel>
  </row>
</dashboard>
Get Updates on the Splunk Community!

Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars this month. This ...

They're back! Join the SplunkTrust and MVP at .conf24

With our highly anticipated annual conference, .conf, comes the fez-wearers you can trust! The SplunkTrust, as ...

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...