Splunk map size of Piechart/How to remove field from pie portion in splunk map

disha — Mon, 28 Sep 2020 17:58:11 GMT

Hi..I have little tricky requirement. I need to display health score of device by Location as "Good" "Bad" and "Fair" on Splunk Map.
But the Size of Pie should be depends upon usercount. and portion of pies should be only Good Fair or Bad. I wrote the query but It is taking Usercount also as a portion of pie. I ned to remove that but Still I want size according to user count.
Intersting fact is : Good+Bad+Fair != Usercount as Usercount is population not the people who are using that app.

Please suggest how I can determine the size of pie according to usercount without using it in portion of pie. As in image..Blue is User count . I need to remove that and just want to display Green red and yellow in pie.

Thanks,
Disha

Re: Splunk map size of Piechart/How to remove field from pie portion in splunk map

Venkat_16 — Mon, 15 Jun 2015 10:11:33 GMT

instead of using a rangemap try using eval and case condition, i would call it something like:

eval severity=case(secs<1 AND secs>3,"Good",secs<=3 AND secs>4,"Fair",secs<=4 AND secs>2000,"worse") | geostats latfield=latitude longfield=longitude count by severity

topic Re: Splunk map size of Piechart/How to remove field from pie portion in splunk map in Dashboards & Visualizations

Splunk map size of Piechart/How to remove field from pie portion in splunk map

Re: Splunk map size of Piechart/How to remove field from pie portion in splunk map