Here's an example based on _internal
data:
index=_internal bytes=* | stats sum(bytes) as sum by sourcetype | eval sourcetype = sourcetype . " (sum=" . sum . ")"
By changing the sourcetype
field I'm basically changing the pie chart labels.
Here's an example based on _internal
data:
index=_internal bytes=* | stats sum(bytes) as sum by sourcetype | eval sourcetype = sourcetype . " (sum=" . sum . ")"
By changing the sourcetype
field I'm basically changing the pie chart labels.
Thank you. It worked.
Like this:
... | chart sum(TotalCost) by ProductCode
Thanks for a pormpt response, Woodcok. Not sure my question is clear. I want to display the actual value i.e. the sum of TotalCost for each product type in the pie chart. ... | chart sum(TotalCost) by ProductCode will only display the pie chart and not the actual values.