Splunk Search

Only show percentages when using pie chart

bharathkumarnec
Contributor

Hi All,

My requirement is to display only percentages in the pie chart not the label names.

I tried below two options:

<option name="charting.chart.showPercent">true</option>
 <option name="charting.chart.showLabels">false</option>

but they are not working as expected.

Kindly help me out if there is any work around?

Regards,
BK

0 Karma
1 Solution

mayurr98
Super Champion

hey
It will show only when showlabels is enabled.
have a look at this doc
https://docs.splunk.com/Documentation/Splunk/7.0.1/Viz/ChartConfigurationReference#Pie_charts

but i must say this is totally possible using search query!
try this run anywhere search and look visualization as pie chart

index=_internal | stats count by log_level | eventstats sum(count) as total | eval count=round(100*count/total,2) |fields- total | eval log_level="".count."%"

and set this parameters in XML

<option name="charting.chart.showPercent">false</option>
<option name="charting.chart.showLabels">true</option>

let me know if this helps!

View solution in original post

0 Karma

niketn
Legend

@bharathkumarnec, if you do not have percent field in your existing stats then you will have to calculate the same. As the final pipe of your search you should perform an eval for your label field and assign value of the percent field

 | eval <yourLabelField>= <yourPercentField>." %"

Following is a run anywhere example based on Splunk's _internal index:

index=_internal sourcetype=splunkd log_level=*
| stats count by log_level
| eventstats sum(count) as total 
| eval perc=round((count/total)*100,1)
| eval log_level=perc." %"
| fields - total perc

alt text

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

bharathkumarnec
Contributor

@niketnilay,

Is there a way that i can use the same colors of the pie chart percentages and labels those are separately written beside pie chart using html?

Regards,
BK

0 Karma

bharathkumarnec
Contributor

@niketnilay, Thanks a lot for the help.

0 Karma

niketn
Legend

@bharathkumarnec, can you please provide what is the query you have right now?

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

mayurr98
Super Champion

I have given you a work around pls check and let me know!

0 Karma

mayurr98
Super Champion

hey
It will show only when showlabels is enabled.
have a look at this doc
https://docs.splunk.com/Documentation/Splunk/7.0.1/Viz/ChartConfigurationReference#Pie_charts

but i must say this is totally possible using search query!
try this run anywhere search and look visualization as pie chart

index=_internal | stats count by log_level | eventstats sum(count) as total | eval count=round(100*count/total,2) |fields- total | eval log_level="".count."%"

and set this parameters in XML

<option name="charting.chart.showPercent">false</option>
<option name="charting.chart.showLabels">true</option>

let me know if this helps!

0 Karma

bharathkumarnec
Contributor

Thanks for the information @mayurr98

This i have tried but could not help me in getting my actual requirement.

Single column with values will not display anything in the pie chart, pie chart is showing values or percentages with field names.

But in my case i dont need field names just a value from the column.

Regards,
BK

0 Karma

mayurr98
Super Champion

give me your search query.

0 Karma

bharathkumarnec
Contributor

@mayurr98, sorry it is working fine..i missed something and have corrected it. Thanks a lot for the help.

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars this month. This ...

They're back! Join the SplunkTrust and MVP at .conf24

With our highly anticipated annual conference, .conf, comes the fez-wearers you can trust! The SplunkTrust, as ...

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...