Dashboards & Visualizations

how to bring a row values to category in pie chart

umsundar2015
Path Finder

I want to explain in detail ,

I have the following search

index=segment|stats sum(Link_CVE_Asset_CVSS_Environmental) as CVSS sum(eval(if(Link_CVE_Asset_Flags=="NULL" AND Bulletin!="NULL",Link_CVE_Asset_CVSS_Environmental, 0))) as "OS Score " sum(eval(if(Bulletin=="NULL" AND Link_CVE_Asset_Flags!="NULL", Link_CVE_Asset_CVSS_Environmental, 0))) as "App Score " by os_name

This search will give the results like ,
OS_name OS Score App score
windows 2223445(score) 1284665
linux 349480(score) 4545
unix 34333(score) 75214

Now i need to bring this osscoreand and appscore in categories in pie chart .The pie chart will show like percentage of os_name with percent values .Here i need this two osscoreand and appscore also like os_name in pie chart.

Please help me

Tags (1)
0 Karma
1 Solution

somesoni2
Revered Legend

How about this

index=segment|stats sum(Link_CVE_Asset_CVSS_Environmental) as CVSS sum(eval(if(Link_CVE_Asset_Flags=="NULL" AND Bulletin!="NULL",Link_CVE_Asset_CVSS_Environmental, 0))) as "OS Score " sum(eval(if(Bulletin=="NULL" AND Link_CVE_Asset_Flags!="NULL", Link_CVE_Asset_CVSS_Environmental, 0))) as "App Score " by os_name
| eval os_name=os_name."(OS:".'OS Score'.", App:".'App Score'.")" | table os_name CVSS

View solution in original post

0 Karma

somesoni2
Revered Legend

How about this

index=segment|stats sum(Link_CVE_Asset_CVSS_Environmental) as CVSS sum(eval(if(Link_CVE_Asset_Flags=="NULL" AND Bulletin!="NULL",Link_CVE_Asset_CVSS_Environmental, 0))) as "OS Score " sum(eval(if(Bulletin=="NULL" AND Link_CVE_Asset_Flags!="NULL", Link_CVE_Asset_CVSS_Environmental, 0))) as "App Score " by os_name
| eval os_name=os_name."(OS:".'OS Score'.", App:".'App Score'.")" | table os_name CVSS
0 Karma

cmerriman
Super Champion

do you want a separate pie chart, then for OS Score and one for App Score?

0 Karma
Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...