Splunk Dev

Visualise chart data as a pie chart

macadminrohit
Contributor

I have final numbers like this :

RED YELLOW GREEN
1 3 9

It is result of a chart command. But when i plot this on a pie chart it only plots a single number(RED) on the entire pie, whereas it should be divided into 3 parts with numbers like 1 3 9

Tags (1)
0 Karma
1 Solution

niketn
Legend

@macadminrohit you can use transpose to get the data in format required by the pie chart. Try to add the following two lines to your current search:

<yourCurrentSearch>
| transpose header_field=Color column_name=Color
| rename "row 1" as count

Following is a run anywhere search based on sample data provided (commands till | table generate the mock data):

| makeresults
| eval data="1,3,9"
| makemv data delim=","
| eval RED=mvindex(data,0),YELLOW=mvindex(data,1), GREEN=mvindex(data,2)
| table RED YELLOW GREEN
| transpose header_field=Color column_name=Color
| rename "row 1" as count
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

woodcock
Esteemed Legend

Try this:

| makeresults
| eval RED=1, YELLOW=3, GREEN=9
| table RED YELLOW GREEN

| rename COMMENT AS "Everything above generates sample event data; everything below is your solution"

| eval _time=now()
| untable _time color count
| fields - _time

macadminrohit
Contributor

In lot of my existing searches , I see _time being evaluated to now() . Not sure what good it does?

0 Karma

macadminrohit
Contributor

Your answer is also one of the solutions.

0 Karma

niketn
Legend

@macadminrohit you can use transpose to get the data in format required by the pie chart. Try to add the following two lines to your current search:

<yourCurrentSearch>
| transpose header_field=Color column_name=Color
| rename "row 1" as count

Following is a run anywhere search based on sample data provided (commands till | table generate the mock data):

| makeresults
| eval data="1,3,9"
| makemv data delim=","
| eval RED=mvindex(data,0),YELLOW=mvindex(data,1), GREEN=mvindex(data,2)
| table RED YELLOW GREEN
| transpose header_field=Color column_name=Color
| rename "row 1" as count
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...