Splunk Search

How to use two different fields to create a pie chart?

shariinPH
Contributor

Hi Splukers,

My problem here is that i have a search :

index=myindexname sourcetype=mysourcetype |stats latest(field1) as postedpayments latest(field2) as exceptions |eval result=round(expected-actual)

What i want to do is that i want to show in the pie chart the value of posted payments and the value of the exceptions

Please help us with our problem

Thanks 🙂

Tags (3)
1 Solution

MuS
SplunkTrust
SplunkTrust

Hi shariinPH;

from the docs http://docs.splunk.com/Documentation/Splunk/6.1.4/Viz/Datastructurerequirementsforvisualizations#Pie...

Pie charts are one dimensional and only support a single series. They work off of tables with just two columns, where the first column contains the labels for each slice of the pie, and the second column contains numerical values that correspond to each label, determining the relative size of each slice. If the table generated by the search contains additional columns, those extra columns have no meaning in the terms of the pie chart and are ignored.

This means your search will not work this way. But there are some ways you can achieve the target; try this run everywhere command:

index=_internal OR index=_audit | stats count(buckets) AS buckets sum(kb) AS sum | transpose

or something like this

index=_internal OR index=_audit | eval type=case(isnotnull(kb), "kb", isnotnull(buckets), "buckets") | stats count by type

adapted to your provide search string, something like this should work:

index=myindexname sourcetype=mysourcetype | stats latest(field1) as postedpayments latest(field2) as exceptions | transpose

hope this helps to get you started ...

cheers, MuS

View solution in original post

MuS
SplunkTrust
SplunkTrust

Hi shariinPH;

from the docs http://docs.splunk.com/Documentation/Splunk/6.1.4/Viz/Datastructurerequirementsforvisualizations#Pie...

Pie charts are one dimensional and only support a single series. They work off of tables with just two columns, where the first column contains the labels for each slice of the pie, and the second column contains numerical values that correspond to each label, determining the relative size of each slice. If the table generated by the search contains additional columns, those extra columns have no meaning in the terms of the pie chart and are ignored.

This means your search will not work this way. But there are some ways you can achieve the target; try this run everywhere command:

index=_internal OR index=_audit | stats count(buckets) AS buckets sum(kb) AS sum | transpose

or something like this

index=_internal OR index=_audit | eval type=case(isnotnull(kb), "kb", isnotnull(buckets), "buckets") | stats count by type

adapted to your provide search string, something like this should work:

index=myindexname sourcetype=mysourcetype | stats latest(field1) as postedpayments latest(field2) as exceptions | transpose

hope this helps to get you started ...

cheers, MuS

shariinPH
Contributor

Thanks @Mus. It works! 😄

demodav
Path Finder

| transpose is what I needed

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...