Splunk Search

Pie Chart Display Color Based On Status (String Value)

arielpconsolaci
Path Finder

I have the below data and I am trying to display it in a Pie chart that will display the group in a corresponding color based on their status.
Orange - In Progress
Green - Completed
Red - Not Started

I can't achieve it using stats/chart as I understood that the count is only based on one category (e.g. Status).
I was able to achieve it using xyseries but in a column chart. Anyone who can advise to display in a pie chart?

alt text

Group Status
A In Progress
B Completed
C Not Started

Tags (1)
0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@arielpconsolacion

In this case we have to use some tric in search and pie logic.
Below is search make crack pie chart and pass numeric value.

<<YOUR SEARCH>>| table Group Status | eval count=1 | append [| stats count | eval Group="C",Status="Not Started"] | append [| stats count | eval Group="A",Status="In Progress" | append [| stats count | eval Group="B",Status="Completed" ]] | sort Status | table Group count

In this search I'm sorting status and arranging resuls. If any status missing in results, then sorting won't work so I have appended messing status with 0 count.

In pie chart color option I have added below option only.

<option name="charting.seriesColors">[0x008000,0xffff00,0xff0000]</option>

Can you please try it?

I hope it works for you.

Thanks
Kamlesh

0 Karma

aniello_cerrato
Path Finder

Hi,

in my case label is dinamically because contain also the %, for example:

30,1% Completed
23% InProgress

But these values are dinamic so change everytime, how we can manage this scenario?

0 Karma

niketn
Legend

@arielpconsolacion,

You can either use fieldColors or seriesColors SimpleXML chart configuration option depending on whether you know the field names or if all fields are always present respectively. Refer to Simple XML Chart Configuration reference documentation: https://docs.splunk.com/Documentation/Splunk/latest/Viz/ChartConfigurationReference#General_chart_pr...

    <option name="charting.fieldColors">{"Completed":0x008000,"In Progress":0xffff00,"Not Started":0xff0000}</option>

With seriesColors you need not provide field names but since the colors are applied in sequence, you have to make sure that all fields/series are always present (or zero if absent) and in the same sequence (in your case you might have to label field names as "1.Completed", "2.In Progress" and "3.Not Started"

    <option name="charting.seriesColors">[0x008000,0xffff00,0xff0000]</option>
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

arielpconsolaci
Path Finder

Hi @niketnilay,

Thank you for your suggestions above. Chart needs a numerical field in that case mine does not have. Or if I can, i can only count per 1 field ( Group or Status in my example). Any advise on this matter?

Group Status
A In Progress
B Completed
C Not Started

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...