Splunk Search

Add values of field and create pie

LauraBre
Communicator

Hello,

I want to create a chart of pie type. I define a field named "Nb_PAN". The values of this field are integers. With this field, I want to create a pie. In this chart, I want to have a part with the sum of the values of the field Nb_PAN which are upper than 1 and a part with the sum of the values of the field Nb_PAN which are equal at 1. But, actually, my search add the number of events where the condition is true and not the sum of the values of the field Nb_PAN with the true condition.

This is my search:
tag::source="TokenizerWatchdogSplunk"| stats sum(eval(Nb_PAN<2)) AS NB_PAN_UNITAIRE, sum(eval(Nb_PAN>1)) AS NB_PAN_MASSSE

My second problem is that I can't do my tie because I don't know how create my chart.

Thanks for your answer.

Tags (2)
0 Karma

Ayn
Legend

If you single out just the events where Nb_PAN is greater than 1 and create a new field with values from just those, you could handle it separately properly:

tag::source="TokenizerWatchdogSplunk"| eval nb_pan_greaterthanone=if(Nb_PAN>1,Nb_PAN,0) | stats count(eval(Nb_PAN=1)) AS NB_PAN_UNITAIRE, sum(nb_pan_greaterthanone) AS NB_PAN_MASSSE
0 Karma

LauraBre
Communicator

Thanks for your answer. With your search, it's the good sum that it does. Now, I'm not able to create a pie with a part NB_PAN_UNITAIRE and a part NB_PAN_MASSSE. It takes only the Nb_PAN_UNITAIRE values. I think that it's because there are two columns in my table and to do a pie we have to do only one column no????

Thanks for your answer.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...