Dashboards & Visualizations

Could you help me with the following search queries and then help me turn the information into a piechart?

hurt
New Member

Good evening guys,

I'm new using this tool, and actually, I have the following tasks to do. I want to ask you if I did well on this one and if you could me help with any tasks I'm missing:

Context:
I was deploying Splunk in a VM (Linux - Ubuntu). Splunk by itself generated events, and my tasks are the following:

  • Amount of different indexes - Single value
    A:/ index=_* | stats distinct_count(index)
    As a single value in screen it show me "4".

  • Index with the highest event count - Single value
    A:/ I did index=_* | stats count by index | sort - count", it show me "_internal as the highest value

  • Indexes distribution events:
    _internal - timechart.
    _thefishbucket - timechart

I don't understand yet. Could someone who understands this please explain it to me because I don't get it...

I don't know if is something like index=_internal | timechart count usenull=f useother=f | sort - count would work...

  • Show in a pie chart the percentages of the total of events. A:/ I did the following, in the tab "Dashboard", I created a pie panel with this information index=_* | stats count by index. Eventually, it showed me a pie chart with the information that I needed (that's what I think)

I don't know if the points that I solved are fine.

Beforehand, I appreciate your help with this topic.

Warm regards,

0 Karma

horsefez
SplunkTrust
SplunkTrust

Hi @hurt,

I can tell you that much:
You made a fine decision choosing Splunk and joining us "the Splunkers" on their ever-awesome journey with this product.
New people to Splunk are most-likely best off learning about the product in an easy way using the following link:
https://www.splunk.com/en_us/resources/getting-started.html

This link and the links on the site will give you a better understanding about what an awesome plattform splunk is.

Get back to me after that, if you have any further questions. 🙂

Regards,
pyro_wood

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...