how to draw a piechart which show the different msg got from splunk query

[neha_h]

Hi,
I am getting below events from my splunk search but how to show them in pie chart.

Correlation Id :\"e7b4b14\", msg : Error is:[{\"code\":688,\"message\":\"api failed with error Invalid request".\"}]","podName":"test-service","category":"ERROR"}

Correlation Id :\"e7b4b14\", msg : Error is:[{\"code\":688,\"message\":\"api failed with error downsteam error".\"}]","podName":"test-service","category":"ERROR"}

basically I want to show the String which is there inside Error is array (basically the message part) in the pie chart for today's date

[to4kawa · Accepted solution]

| makeresults 
| eval _raw="raw
Correlation Id :\"e7b4b14\", msg : Error is:[{\"code\":688,\"message\":\"api failed with error Invalid request\".\"}]\",\"podName\":\"test-service\",\"category\":\"ERROR\"}
Correlation Id :\"e7b4b14\", msg : Error is:[{\"code\":688,\"message\":\"api failed with error downsteam error\".\"}]\",\"podName\":\"test-service\",\"category\":\"ERROR\"}"
| multikv forceheader=1
| rex "\[(?<codes>.*)\]"
| spath input=codes
| stats count by message

Viz >> Pie Chart

[neha_h]

Thank you @to4kawa ,
Can we group 1 type of error and it's count in 1 slice and other type and it's count in 2nd slice in pie chart?

[to4kawa]

yes, you can.

[neha_h]

how can i do that?

[neha_h]

Thanks, I could do that with | stats count by codes, Thank you so much @to4kawa

[to4kawa]

use eval to collect other types