I want to explain in detail ,
I have the following search
index=segment|stats sum(Link_CVE_Asset_CVSS_Environmental) as CVSS sum(eval(if(Link_CVE_Asset_Flags=="NULL" AND Bulletin!="NULL",Link_CVE_Asset_CVSS_Environmental, 0))) as "OS Score " sum(eval(if(Bulletin=="NULL" AND Link_CVE_Asset_Flags!="NULL", Link_CVE_Asset_CVSS_Environmental, 0))) as "App Score " by os_name
This search will give the results like ,
OS_name OS Score App score
windows 2223445(score) 1284665
linux 349480(score) 4545
unix 34333(score) 75214
Now i need to bring this osscoreand and appscore in categories in pie chart .The pie chart will show like percentage of os_name with percent values .Here i need this two osscoreand and appscore also like os_name in pie chart.
Please help me
How about this
index=segment|stats sum(Link_CVE_Asset_CVSS_Environmental) as CVSS sum(eval(if(Link_CVE_Asset_Flags=="NULL" AND Bulletin!="NULL",Link_CVE_Asset_CVSS_Environmental, 0))) as "OS Score " sum(eval(if(Bulletin=="NULL" AND Link_CVE_Asset_Flags!="NULL", Link_CVE_Asset_CVSS_Environmental, 0))) as "App Score " by os_name
| eval os_name=os_name."(OS:".'OS Score'.", App:".'App Score'.")" | table os_name CVSS
How about this
index=segment|stats sum(Link_CVE_Asset_CVSS_Environmental) as CVSS sum(eval(if(Link_CVE_Asset_Flags=="NULL" AND Bulletin!="NULL",Link_CVE_Asset_CVSS_Environmental, 0))) as "OS Score " sum(eval(if(Bulletin=="NULL" AND Link_CVE_Asset_Flags!="NULL", Link_CVE_Asset_CVSS_Environmental, 0))) as "App Score " by os_name
| eval os_name=os_name."(OS:".'OS Score'.", App:".'App Score'.")" | table os_name CVSS
do you want a separate pie chart, then for OS Score and one for App Score?