How to show the percentage of each terms in kibana dashboard

[subash (subash prabhakar)]

Hello,

I'm working on a requirement where I'll have to create a dashboard that shows the Inbound traffic (in percentage) of each interface in the network.

I have the fields 'system.network.in.bytes' having the inbound traffic value in bytes and 'system.network.name' having values like Ethernet or Ethernet2 or Ethernet5 etc.,

I want to calculate the Total sum of system.network.in.bytes and the sum of system.network.in.bytes of each value in the system.network.name field and then to calculate the percentage traffic of each network.

For example: (Total In bytes of Ethernet2 / Total In bytes) * 100

I tried bucket script and filter ratio in TSVB but it is not giving the expected result.

Please help me to make it work. Thanks in advance.

[Sandeep_Raju (Sandy)]

You can use enhanced table plugin and create table using enhanced table by using computed column use your formula.

Else you can create a scripted field and use the same formula and use that scripted field.

[subash (subash prabhakar)]

Hi @Sandeep_Raju,

Thanks for responding.

For percentange calculation, I'll have to calculate Total sum of system.network.in.bytes and the sum of system.network.in.bytes of each system.network.name.

In enhanced data table, if I split the rows by system.network.name, I will get the sum of system.network.in.bytes of each network name but I will miss the total sum. If so, then I cannot calculate the percentange.

I'm not sure how it can be achieved using scripted fields. Could you please give me some idea of how to use scripted field in this scenario?

[Rajsekhar_Haldar1 (Rajsekhar Haldar)]

Hi @subash,
You can use a painless script to generate a new field having the calculated value in percentage and then use that field in the kibana dashboard.

[subash (subash prabhakar)]

Hi @Rajsekhar_Haldar1, @Sandeep_Raju

Sorry, I forgot to mention this in the post.
The sum and percentage calculation are based on the selected time range. If the user selects last 15 minutes in the time picker then we'll have to do percentage calculation with the data of last 15 mins.

Is this still possible using painless script?

[Rajsekhar_Haldar1 (Rajsekhar Haldar)]

@subash ,
You would have to use the time filter in top of dashboard and once the required the time range is selected then the calculation would be based on that time range only and the result will be displayed accordingly in your dashboard for that particular generated field.
Thanks

[subash (subash prabhakar)]

Hi @Rajsekhar_Haldar1 ,

I have no idea of how to use the painless script for generating a new field that stores the calculated value. Could you please help me with a sample code snippet, if any?

[Marco_Liberati]

Hi @subash

you can use Lens formula to achieve what you are looking for.
The trick is to use the overall_sum function in formula to compute the percentage.

Here's a configuration example:

In the Metrics configuration you can find the formula:

100 * sum(system.network.in.bytes) / overall_sum(sum(system.network.in.bytes))

(Here bytes has been replaced with your system.network.in.bytes one)

[subash (subash prabhakar)]

Thanks a lot!!!! @Marco_Liberati

I was struggling with painless script but didn't know that it is very much easier in lens.

[Rajsekhar_Haldar1 (Rajsekhar Haldar)]

Yes it is easier, thank you.