Splunk Search

How to combine a set of values as 'Other' in a pie chart?

spamphile
Engager

I'm trying to display a pie chart like so:

chart count by transaction.inputSource | lookup transaction_input_sources code AS transaction.inputSource OUTPUT transaction_input_source AS transaction.inputSource

There are only 5 input sources I really care about in the pie chart. The other input sources I would like to combine and just show as one "Other" slice. In my lookup table, I've named the input sources I don't care about as "Other". But now when the chart renders, it shows each of those values as its own slice:

alt text

How do I combine these values as one slice in the pie chart? Any help is greatly appreciated. Thanks!

0 Karma
1 Solution

amitm05
Builder

You'd have to combine the remaining input sources (which you want to show as Other) as one and then apply your stats function on it. That will solve it for you.

E.g. Lets say you have input_source values as - A, B, C, D, E, F, G, H.
You want A, B, C, D, E to reflect as they are and remaining F, G, H as Other.
You need to do an eval before your stats command which would combine F, G, H in one. Something like -
....... | eval input_source = case(input_source == "F", "Other", input_source == "G", "Other", input_source == "H", "Other", 1==1, input_source ) | stats ...

Basically, with above eval, your input_source will now have the values as - A, B, C, D, E, Other.
So when you do a stats like -
| stats count by input_source

This would create your Pie Chart with your 5 required input sources and combine the rest in "Other".

Hope this helps.
Please accept this as an answer if it resolves your problem.

View solution in original post

amitm05
Builder

You'd have to combine the remaining input sources (which you want to show as Other) as one and then apply your stats function on it. That will solve it for you.

E.g. Lets say you have input_source values as - A, B, C, D, E, F, G, H.
You want A, B, C, D, E to reflect as they are and remaining F, G, H as Other.
You need to do an eval before your stats command which would combine F, G, H in one. Something like -
....... | eval input_source = case(input_source == "F", "Other", input_source == "G", "Other", input_source == "H", "Other", 1==1, input_source ) | stats ...

Basically, with above eval, your input_source will now have the values as - A, B, C, D, E, Other.
So when you do a stats like -
| stats count by input_source

This would create your Pie Chart with your 5 required input sources and combine the rest in "Other".

Hope this helps.
Please accept this as an answer if it resolves your problem.

spamphile
Engager

Thanks so much

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...