How can I display our search results as a percent in a single value panel?

[j_r]

Hi
my basesearch...

index = lc source= X
|stats count by status

...gets me the amount status by status:

Status Amount
Available 88
InProgress 45
UnAvailable 3

I would like to display the utilization (InProgress/Total) as percent with a single value panel. I tried already with a subsearch an eval, but it didn't work 😕

[niketn]

@j_r from your requirement seems like you need percent of InProgress and Total over time so that Single Value has both percent and Sparkline for trend. This is different from stats which is overall Total and percent.

Try the following:

 index = lc source= X
| timechart count as Total count(eval(status="InProgress")) as InProgress
| eval perc=round((InProgress/Total)*100,2)
| fillnull value=0
| table _time perc

Following is a run anywhere search based on Splunk's _internal index and splunkd_ui_access sourcetype which give Success % access over time on similar lines.

index=_internal sourcetype=splunkd_ui_access
| timechart count as Total count(eval(status=200)) as Success
| eval perc=round((Success/Total)*100,2)
| fillnull value=0
| table _time perc

[renjith_nair]

@j_r,

Try

index = lc source= X  |stats count by status
|eventstats sum(count) as total
|eval perc=round((count/total)*100,2)

[j_r]

this gives me the results i need. Thanks 🙂
but how can i display the utilization (InProgress/Toatal) as a single value panel?

[renjith_nair]

@j_r,
Do you want to show only In Progress or for all status? Also do you want to show actual perc (40%) or as a string (InProgress/Total) for eg. (40/100) ?

[j_r]

I would like to show the actual perc (result of InProgress/Total) as a single value panel including sparklines and trend indicators.

[renjith_nair]

Sparklines and trend indicators can be used only if you have a trend, i.e. value of this utilization over a period of time. A simple single value visualization based on perc is below. It has both conditions - for single value and for a trend

<dashboard>
  <label>Single Value Utilization</label>
  <row>
    <panel>
      <title>Single Value Based on "Single Value" Not A "Trend"</title>
      <single>
        <search>
          <query>index=_* earliest=-1m
| stats count by index
| eventstats sum(count) as _total
| eval perc=round((count/_total)*100,2)
| fields perc,index
| where index="_internal"</query>
          <earliest>-15m</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="colorBy">value</option>
        <option name="colorMode">none</option>
        <option name="drilldown">none</option>
        <option name="numberPrecision">0</option>
        <option name="rangeColors">["0x53a051","0xf8be34","0xdc4e41"]</option>
        <option name="rangeValues">[50,80]</option>
        <option name="refresh.display">progressbar</option>
        <option name="showSparkline">1</option>
        <option name="showTrendIndicator">1</option>
        <option name="useColors">1</option>
      </single>
    </panel>
  </row>
  <row>
    <panel>
      <title>Single Value Based on "Trend"</title>
      <single>
        <search>
          <query>index=_internal 
| timechart count span=1m</query>
          <earliest>-15m</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">none</option>
        <option name="rangeColors">["0x53a051","0x0877a6","0xf8be34","0xf1813f","0xdc4e41"]</option>
        <option name="useColors">1</option>
      </single>
    </panel>
  </row>
</dashboard>