Splunk Search

Legend in Pie Chart Dashboard

skoelpin
SplunkTrust
SplunkTrust

I made a dashboard which has 2 pie charts and their status codes. How do I include a legend showing what the status codes mean?

Example, one pie chart shows only 3 status codes so far for today (200, 400, and 699).

status code = 200 means a successful web service call
status code = 400 means an unsuccessful web service call
status code = 699 means failed payment method

I want a legend to show up which gives a description of what the status codes represent so anyone looking at the dashboard could instantly know without having to go ask or look it up

0 Karma
1 Solution

justinatpnnl
Communicator

I did something similar, but instead of a legend I modified the fields that the pie chart was displaying.

I started with a simple lookup table to map to my status codes:

status,description
200,OK
400,Bad Request
401,Unauthorized
403,Forbidden
404,Not Found
500,Internal Server Error
501,Not Implemented
502,Bad Gateway
503,Service Unavailable
504,Gateway Timeout
505,HTTP Version Not Supported

There is also an http_status.csv file available on the Splunk Wiki: http://wiki.splunk.com/Http_status.csv

Next I just mapped the description to the status codes:

<query to get status codes> | stats count by status | lookup http_status status as status OUTPUT description

Then I created a new field that combines the status and the description and dumped it in a table with the count:

| eval status_description = status + " - " + description | table status_description, count

Now when you view the pie chart, you will get something like this:

Pie chart with modified description

Side note: If you didn't want to use a lookup table and only had a few status codes you wanted to display, you could also use a case statement to create your custom fields:

| eval status_description = case(status=200, "200 - Successful web service call", status=400, "400 - Unsuccessful web service call", status=669, "Failed payment method")

View solution in original post

justinatpnnl
Communicator

I did something similar, but instead of a legend I modified the fields that the pie chart was displaying.

I started with a simple lookup table to map to my status codes:

status,description
200,OK
400,Bad Request
401,Unauthorized
403,Forbidden
404,Not Found
500,Internal Server Error
501,Not Implemented
502,Bad Gateway
503,Service Unavailable
504,Gateway Timeout
505,HTTP Version Not Supported

There is also an http_status.csv file available on the Splunk Wiki: http://wiki.splunk.com/Http_status.csv

Next I just mapped the description to the status codes:

<query to get status codes> | stats count by status | lookup http_status status as status OUTPUT description

Then I created a new field that combines the status and the description and dumped it in a table with the count:

| eval status_description = status + " - " + description | table status_description, count

Now when you view the pie chart, you will get something like this:

Pie chart with modified description

Side note: If you didn't want to use a lookup table and only had a few status codes you wanted to display, you could also use a case statement to create your custom fields:

| eval status_description = case(status=200, "200 - Successful web service call", status=400, "400 - Unsuccessful web service call", status=669, "Failed payment method")
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...