Splunk Search

How to create a pie chart with only true false values

disillusioned
New Member

I am working with this search:

index=lab-testresults type=browser NOT(browser="UK*" OR browser="Firefox") suiteID="*"
| stats latest(success) as success by browser noxID 
| stats count(eval(success="true")) as PassCount
    count(eval(success="false")) as FailCount
    count as Total by browser
| fields browser, PassCount, FailCount, Total

but when I use the trellis on my visualization, the pie charts only show a single value like this:
alt text

The Question:
How do I get it so that each of my pie charts shows the correct slice of passes and failures according to the data and not just one field like it is now?

I am working with this search query:

index=lab-testresults type=browser NOT(browser="UK*" OR browser="Firefox") suiteID="*"
| stats latest(success) as success by browser noxID 
| stats count(eval(success="true")) as PassCount
    count(eval(success="false")) as FailCount
    count as Total by browser
| fields browser, PassCount, FailCount, Total

but every time I use trellis on a dashboard it shows this:

alt text

This only shows a whole pie chart, but we can see that both counts are there, and adding the Total that we define in the count above also doesn't change the problem.
I would like the pie chart to display the passes and the failures as two separate parts of the pie. Is there any way to do this?

(additional context: I am later going to add charting.fieldColors to this pie so that passes are green and failures are red, so any way to do show the two parts of the pie, with labels for passes and fails, and finally adding in the colors would be great!)

Thanks!

0 Karma

FrankVl
Ultra Champion

Try the chart command, instead of stats:

index=lab-testresults type=browser NOT(browser="UK*" OR browser="Firefox") suiteID="*"
| stats latest(success) as success by browser noxID
| chart count over browser by success
| rename true as PassCount
| rename false as FailCount
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi disillusioned,
which field do you used for the "Split by" option ?

<option name="trellis.splitBy">broser</option>

For more information see the Splunk Dashboard Examples App ( https://splunkbase.splunk.com/app/1603/ ).

Bye.
Giuseppe

0 Karma
Get Updates on the Splunk Community!

Welcome to the Splunk Community!

(view in My Videos) We're so glad you're here! The Splunk Community is place to connect, learn, give back, and ...

Tech Talk | Elevating Digital Service Excellence: The Synergy of Splunk RUM & APM

Elevating Digital Service Excellence: The Synergy of Real User Monitoring and Application Performance ...

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...