Splunk Search

How to create a chart from a search finding percentages?

brywilk_umich
Path Finder

I know Im likely missing something easy, but I cant seem to get the output how I would like. I have the below search that works great to find the percentage available but I would like to make this into a pie chart with Available and Unavailable numbers

index=nagios tag::src_host=collaboration (perfdata="HOSTPERFDATA" hoststate) OR (name="check_smtp" perfdata="SERVICEPERFDATA") | eval availabilityStatus=if(hoststate="DOWN" OR severity="CRITICAL","Unavailable","Available") | stats count(eval(availabilityStatus="Unavailable")) as unavailCount, count(eval(availabilityStatus="Available")) as availCount, count as totalCount | eval percentAvailable=(availCount/totalCount)*100

thanks all

0 Karma
1 Solution

somesoni2
Revered Legend

Try this

index=nagios tag::src_host=collaboration (perfdata="HOSTPERFDATA" hoststate) OR (name="check_smtp" perfdata="SERVICEPERFDATA") | eval availabilityStatus=if(hoststate="DOWN" OR severity="CRITICAL","Unavailable","Available") | stats count by availabilityStatus

This should give a pie chart with count of 'Available' and 'Unavailable' counts (with percent on tooltip,calculated automatically.

View solution in original post

somesoni2
Revered Legend

Try this

index=nagios tag::src_host=collaboration (perfdata="HOSTPERFDATA" hoststate) OR (name="check_smtp" perfdata="SERVICEPERFDATA") | eval availabilityStatus=if(hoststate="DOWN" OR severity="CRITICAL","Unavailable","Available") | stats count by availabilityStatus

This should give a pie chart with count of 'Available' and 'Unavailable' counts (with percent on tooltip,calculated automatically.

Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...