Dashboards & Visualizations

How to make a pie chart in Splunk?

zacksoft
Contributor

I am creating a pie chart and this should contain two pieces . One piece should contain, "How much percentage of the entire logs contain the word "abend890" and the second piece should contain the "rest of the logs that do not contain that word"

I am trying something like below, it won't work.

host="All_Error_Logs" 
| eval word=case(like(_raw,"%abend890%"),"abend890",like(_raw, NOT"%abend890%"),"NOT_ABEND890")
| stats count by word
0 Karma
1 Solution

renjith_nair
SplunkTrust
SplunkTrust

Hi @zacksoft,

It would be more faster if you could extract the field and do a percentage on that. However, this should work for your above requirement.

host="All_Error_Logs" |stats count(eval(match(_raw,"abend890"))) as abend890,count(eval(NOT match(_raw,"abend890"))) as "NOT_abend890",count as total
|eval match_perc=round((abend890/total)*100,2),not_match_perc=round((NOT_abend890/total)*100,2)
Happy Splunking!

View solution in original post

0 Karma

renjith_nair
SplunkTrust
SplunkTrust

Hi @zacksoft,

It would be more faster if you could extract the field and do a percentage on that. However, this should work for your above requirement.

host="All_Error_Logs" |stats count(eval(match(_raw,"abend890"))) as abend890,count(eval(NOT match(_raw,"abend890"))) as "NOT_abend890",count as total
|eval match_perc=round((abend890/total)*100,2),not_match_perc=round((NOT_abend890/total)*100,2)
Happy Splunking!
0 Karma

zacksoft
Contributor

will it not be required to add asterisk(*) before and after abend890 in the eval match statement?

0 Karma

renjith_nair
SplunkTrust
SplunkTrust

This function compares the regex string REGEX to the value of SUBJECT and returns a Boolean value. It returns TRUE if the REGEX can find a match against any substring of SUBJECT. You could test it with simple search

    index=_internal sourcetype="splunkd*"|stats count by sourcetype|stats count(eval(match(sourcetype,"access"))) as "web" ,  count(eval(NOT match(sourcetype,"access"))) as "Not Web"
Happy Splunking!
0 Karma

pradeepkumarg
Influencer
| eval word=if(searchmatch("\*abend890\*"), "ABEND", "NOT_ABEND") | stats count by word 

zacksoft
Contributor

Thanks for the response.
I am bit confused whether to use ("abend") or ("#abend#")

My sample logs are like this
1. fdjihfklsdfjsdhgrfgkjsdflk*abend890iofjsdfjs
2. shshffsjjfmi
crosoft.abend890.erase*,hhhhfjksdzfhskjfhskdjfhsk

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...