Dashboards & Visualizations

How to change dashboard panel from line graph to pie chart

mhtedford
Communicator

I have a line graph tracking different call sources over the past 6 months:
alt text

Here is the search code I have written:

index=webex_sentiment JoinedFrom != "No" AND JoinedFrom != "Yes" AND (Rating=1 OR Rating=2)  | eval surveyDate=strptime(Started,"%m/%d/%Y %H:%M") | eval YearWeek=strftime(surveyDate,"%Y-%U") | search YearWeek>2016-11  | chart  count(Rating) by YearWeek JoinedFrom

Rather than showing each source as an individual line, I want to create a pie chart that displays each call source as a percentage over the past six months.
When I switch my visualization to Pie chart, this is what appears:

alt text

The data is incorrectly grouped by date, rather than type.
I believe I need to change my search query. Please advise.

1 Solution

woodcock
Esteemed Legend

I like the trellis idea because it keeps both vectors ( JoinedFrom and YearWeek ) but it looks like you are just trying to ditch YearWeek so just swap the order like this:

| chart count(Rating) by YearWeek JoinedFrom

Or better yet, drop it entirely like this:

| chart count(Rating) by JoinedFrom

View solution in original post

woodcock
Esteemed Legend

I like the trellis idea because it keeps both vectors ( JoinedFrom and YearWeek ) but it looks like you are just trying to ditch YearWeek so just swap the order like this:

| chart count(Rating) by YearWeek JoinedFrom

Or better yet, drop it entirely like this:

| chart count(Rating) by JoinedFrom

mhtedford
Communicator

@woodcock

Thanks so much!

For anyone interested, here is the graph I was looking for: http://imgur.com/a/jTe7Q

cmerriman
Super Champion

Can you try to swap your by statement?

 | chart  count(Rating) by JoinedFrom YearWeek 

You would also need trellis enabled to split it by YearWeek. Splunk version 6.6

Otherwise pie will only work with one by statement, so I would remove the YearWeek, or show multiple panels for each YearWeek

mhtedford
Communicator

@cmerriman

How do I split by YearWeek with trellis?

cmerriman
Super Champion

you'll need to be on splunk version 6.6 to use the trellis option. https://docs.splunk.com/Documentation/SplunkCloud/6.6.0/Viz/VisualizationTrellis

When you're on the Visualization tab, you'll see a Trellis button next to Format. When you click on it, you'll see a checkbox for Use trellis layout. There is a Split by option and you can choose to split by various available fields or the aggregation of your fields.

There is a syntaxing note that I'll forewarn you about, and it's that I recommend you end the syntax with a command like stats, chart, timechart, etc. and not an eval command, because the split by option sometimes will only allow you to split by the aggregation in those cases.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...