https://community.splunk.com/t5/Monitoring-Splunk/CPU-Pie-Chart/m-p/81032#M1002 <P>Have been trying to get a pie chart that reps the cpu usage. IE the following log format.<BR /> Any one have a clue if I can create a pie chart with a multikv fields?</P> <P>CPU LOAD USER NICE SYS IDLE BLOCK SWAIT INTR SSYS<BR /> avg 0.74 8.0% 2.8% 11.8% 77.4% 0.0% 0.0% 0.0% 0.0% </P> Fri, 23 Sep 2011 20:22:49 GMT jlaigo2 2011-09-23T20:22:49Z https://community.splunk.com/t5/Monitoring-Splunk/CPU-Pie-Chart/m-p/81032#M1002 <P>Have been trying to get a pie chart that reps the cpu usage. IE the following log format.<BR /> Any one have a clue if I can create a pie chart with a multikv fields?</P> <P>CPU LOAD USER NICE SYS IDLE BLOCK SWAIT INTR SSYS<BR /> avg 0.74 8.0% 2.8% 11.8% 77.4% 0.0% 0.0% 0.0% 0.0% </P> Fri, 23 Sep 2011 20:22:49 GMT https://community.splunk.com/t5/Monitoring-Splunk/CPU-Pie-Chart/m-p/81032#M1002 jlaigo2 2011-09-23T20:22:49Z https://community.splunk.com/t5/Monitoring-Splunk/CPU-Pie-Chart/m-p/81033#M1003 <P>Assuming you have the fields extracted, you can use <CODE>transpose</CODE> to get a chart formatted in a way that can be used for a pie chart. Since a pie chart doesn't deal with time-series data, it will use only the first row of the table it's supplied with. It's cleaner to add <CODE>| head 1</CODE> to the search to show explicitly what data is used for the pie chart though.</P> <PRE><CODE>&lt;yourbasesearch&gt; | head 1 | table USER NICE SYS IDLE BLOCK SWAIT INTR SSYS | transpose </CODE></PRE> Fri, 23 Sep 2011 20:39:10 GMT https://community.splunk.com/t5/Monitoring-Splunk/CPU-Pie-Chart/m-p/81033#M1003 Ayn 2011-09-23T20:39:10Z https://community.splunk.com/t5/Monitoring-Splunk/CPU-Pie-Chart/m-p/81034#M1004 <P>Works perfect thanks for the help:)</P> Fri, 23 Sep 2011 21:04:24 GMT https://community.splunk.com/t5/Monitoring-Splunk/CPU-Pie-Chart/m-p/81034#M1004 jlaigo2 2011-09-23T21:04:24Z