Splunk Search

How should I convert my bar chart to a meaningful pie chart?

athorat
Communicator

I have a search which returns transaction status for each resource.
Resource A: Transacation Status = Success

And
Transacation Status = Fail

Similarly for
Resource B :Transacation Status = Success

AND
Transacation Status = FAIL

The visualization does appear good in a Bar chart. How can I change it to a meaningful pie chart (Latency can be ignored)?

index="np_dpa" sourcetype="DP:SIT:SYSLOG" PROXYNAME="PASTelematicsAPI" | chart avg(Latency) as Avg_Response_Time count over Resource  by  TransactionStatus

Also, If I have to keep it as a bar chart, the Resource name which appears on the X-axis is aligned to left. Can this be aligned to center?

Tags (2)
0 Karma

mporath_splunk
Splunk Employee
Splunk Employee

First of all, I would recommend changing your search from using chart to stats. That formats the data in a way that's well suited for both bar and pie charts.

index="np_dpa" sourcetype="DP:SIT:SYSLOG" PROXYNAME="PASTelematicsAPI" | stats avg(Latency) as Avg_Response_Time count  by  TransactionStatus

Next, to decide whether to display a pie chart or a bar chart, it depends what you want to get out of the visualization.

  • I'm interested in how all transactions break down => Pie chart
  • I'm interested in how many transactions succeed/fail => Bar chart

As for the label formatting, unfortunately it's not possible to change the alignment of axis labels.

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars this month. This ...

They're back! Join the SplunkTrust and MVP at .conf24

With our highly anticipated annual conference, .conf, comes the fez-wearers you can trust! The SplunkTrust, as ...

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...