Hello,
I have a problem to create a pie. This is my search:
tag::source="TokenizerWatchdogSplunk"| eval nb_pan_greaterthanone=if(Nb_PAN>1,Nb_PAN,0) | stats count(eval(Nb_PAN=1)) AS NBPANUNITAIRE, sum(nb_pan_greaterthanone) AS NBPANMASSE
I'm not able to create a pie with a part NBPANUNITAIRE and a part NBPANMASSSE. It takes only the Nb_PAN_UNITAIRE values. I think that it's because there are two columns in my table and to do a pie we have to do only one column no???? How can I resolve this problem???
Thanks for your answer.
Try this
tag::source="TokenizerWatchdogSplunk"|
eval series=case(Nb_PAN==1, "NBPANUNITAIRE", Nb_PAN>1, "NBPANMASSE", Nb_PAN<1, "Other") |
stats sum(Nb_PAN) by series
Try this
tag::source="TokenizerWatchdogSplunk"|
eval series=case(Nb_PAN==1, "NBPANUNITAIRE", Nb_PAN>1, "NBPANMASSE", Nb_PAN<1, "Other") |
stats sum(Nb_PAN) by series
Thanks very much. Your answer is very good. My problem is resolved.
Thanks
Use transpose
:
tag::source="TokenizerWatchdogSplunk"| eval nb_pan_greaterthanone=if(Nb_PAN>1,Nb_PAN,0) | stats count(eval(Nb_PAN=1)) AS NBPANUNITAIRE, sum(nb_pan_greaterthanone) AS NBPANMASSE | transpose
The answer of Iguinn resolved my problem. The name of the column was present in the information when I moved the mouse over. Thanks very much for your answer.
That column will not be used when creating the pie chart, so it shouldn't be a problem I think?
Thanks, I do it, it's perfect. But now, I search how can I rename the name of the column because I have a column named row1 and I want to change her name.
Thanks for your answer.