Dashboards & Visualizations

Create a pie with a table of two columns

LauraBre
Communicator

Hello,

I have a problem to create a pie. This is my search:

tag::source="TokenizerWatchdogSplunk"| eval nb_pan_greaterthanone=if(Nb_PAN>1,Nb_PAN,0) | stats count(eval(Nb_PAN=1)) AS NBPANUNITAIRE, sum(nb_pan_greaterthanone) AS NBPANMASSE

I'm not able to create a pie with a part NBPANUNITAIRE and a part NBPANMASSSE. It takes only the Nb_PAN_UNITAIRE values. I think that it's because there are two columns in my table and to do a pie we have to do only one column no???? How can I resolve this problem???

Thanks for your answer.

Tags (1)
0 Karma
1 Solution

lguinn2
Legend

Try this

tag::source="TokenizerWatchdogSplunk"| 
eval series=case(Nb_PAN==1, "NBPANUNITAIRE", Nb_PAN>1, "NBPANMASSE", Nb_PAN<1, "Other") |
stats sum(Nb_PAN) by series

View solution in original post

lguinn2
Legend

Try this

tag::source="TokenizerWatchdogSplunk"| 
eval series=case(Nb_PAN==1, "NBPANUNITAIRE", Nb_PAN>1, "NBPANMASSE", Nb_PAN<1, "Other") |
stats sum(Nb_PAN) by series

LauraBre
Communicator

Thanks very much. Your answer is very good. My problem is resolved.

Thanks

0 Karma

Ayn
Legend

Use transpose:

tag::source="TokenizerWatchdogSplunk"| eval nb_pan_greaterthanone=if(Nb_PAN>1,Nb_PAN,0) | stats count(eval(Nb_PAN=1)) AS NBPANUNITAIRE, sum(nb_pan_greaterthanone) AS NBPANMASSE | transpose

LauraBre
Communicator

The answer of Iguinn resolved my problem. The name of the column was present in the information when I moved the mouse over. Thanks very much for your answer.

0 Karma

Ayn
Legend

That column will not be used when creating the pie chart, so it shouldn't be a problem I think?

0 Karma

LauraBre
Communicator

Thanks, I do it, it's perfect. But now, I search how can I rename the name of the column because I have a column named row1 and I want to change her name.

Thanks for your answer.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...