Splunk Search

How to round a percentage value in a pie chart to 1 decimal place?

dvg06
Path Finder

Hi,

I have the entry below in my dashboard which shows the percent value in pie chart, but defaults to 3 decimal places. Can I change it to 1?

Below is my search. Please let me know if any change to search can help?

| pivot PIVOT_NAME $STATE$ dc(ticket_id) AS Count SPLITROW src_user_category AS Source FILTER affect_dest is $APPLICATION|s$ FILTER src_user_category is $SOURCE|s$ FILTER status_name is $status|s$ FILTER severity is $severity|s$ FILTER affect_dest is $application|s$ FILTER category is $category|s$ SORT 100 src_user_category ROWSUMMARY 0 COLSUMMARY 0 NUMCOLS 0 SHOWOTHER 1
0 Karma

niketn
Legend

Pie chart calculates its own <field>% value for building accurate slices for the pie chart. While we can not round off that percentage, we can calculate rounded percentage our self and add to the label field so that rounded value is displayed as when the Pie chart loads. Following steps are required:

Step 1: <your search>|eventstats count(<field name>) as Total
Use eventstats to count the total of events to be plotted on Pie Chart. This could be either count or count(<field name>) as per need.

Step 2: stats count(<field name>) as Count values(Total) as Total by <group field name>|
Actual stats command for the pie chart. Aggregate function values(Total) will give the distinct value of final total (or 100% value). Use by clause to group events in order to form slices for the pie chart.

Step 3: eval percent=round((Count/Total)*100,2)|
Calculate percent based on Count and Total calculated in previous step.

Step 4: eval <group field name>= <group field name>."(Count=".Count."), ".percent."%"|
Change the Group Field Name(which forms slices of the pie chart) to contain Group Name, Count and percent for each slice.

Step 5: table <group field name>, Count
Label(Group Field Name) and value (Count) for the Pie Chart Visualization.

Example: Modify and add to your existing search. Where foo is the statistical field for values of slices and bar is the group by field for label of slices of pie chart.

|eventstats count(foo) as Total
stats count(foo) as Count values(Total) as Total by bar|
eval percent=round((Count/Total)100,2)|
eval **bar
* = bar."(Count=".Count."), ".percent."%"|
table bar, foo

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

gyslainlatsa
Motivator

hi dvg06,

Here is a example of round stats average to 2 decimal places, if you like to 1 decimal, try to replace 2 by 1 in the query below

stats count by field1 | stats avg(count) as avg_count | eval avg_count=round(avg_count,2) |

0 Karma

javiergn
Super Champion

Have you tried?

eval percent = round(percent,1)
0 Karma

dvg06
Path Finder

Sorry, somehow my dashboard xml entry was missed from the original post. Below is the entry I have.

<option name="charting.chart.showPercent">true</option>

and it takes 3 as the default value for number of decimal places. Eval did not work for me. Can you help please?

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars this month. This ...

They're back! Join the SplunkTrust and MVP at .conf24

With our highly anticipated annual conference, .conf, comes the fez-wearers you can trust! The SplunkTrust, as ...

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...