Hi Venky,
I have no issue with the following query, can you try it please:
<chart>
<search>
<query> your search | stats count by application </query>
...
</search>
...
<option name="charting.legend.labels">[Green,Red]</option>
<option name="charting.seriesColors">[0x53a051,0xFF0000]</option>
</chart>
I tested it with:
<chart>
<search>
<query>| makeresults
| eval app="app1:Red,app2:Green,app3:Green,app4:Red,app5:Green"
| makemv app delim=","
| rex field=app "(?<application>[^:]+)"
| rex field=app ":(?<status>.+)"
| stats count by application</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
<sampleRatio>1</sampleRatio>
</search>
<option name="charting.chart">pie</option>
<option name="charting.drilldown">none</option>
<option name="charting.legend.labels">[Green,Red]</option>
<option name="charting.seriesColors">[0x53a051,0xFF0000]</option>
<option name="refresh.display">progressbar</option>
</chart>
And I obtained the pie chart as needed
Hope it helps
Best regards,
Adrian
... View more