https://community.splunk.com/t5/Dashboards-Visualizations/How-to-create-a-pie-chart-of-percentages-out-of-just-numeric/m-p/254139#M15897 <P>yup thanks!</P> Fri, 14 Oct 2016 17:18:51 GMT smhsplunk 2016-10-14T17:18:51Z https://community.splunk.com/t5/Dashboards-Visualizations/How-to-create-a-pie-chart-of-percentages-out-of-just-numeric/m-p/254126#M15884 <P>Trying to do a pie chart out of just numeric values, getting values from different tokens and using them for this piechart, I just want to show them as % of the entire sum of numeric token values. How do you create a list of values for piechart?</P> <PRE><CODE>index=main host="*" | eval token1="$token1$" | eval token2="$token2$" | eval token3="$token3$" | eval token4 = "$token4$" | eval token_times = list(token1, token2, token3, token4) | stats values by token_times </CODE></PRE> Thu, 13 Oct 2016 22:39:51 GMT https://community.splunk.com/t5/Dashboards-Visualizations/How-to-create-a-pie-chart-of-percentages-out-of-just-numeric/m-p/254126#M15884 smhsplunk 2016-10-13T22:39:51Z https://community.splunk.com/t5/Dashboards-Visualizations/How-to-create-a-pie-chart-of-percentages-out-of-just-numeric/m-p/254127#M15885 <P>Need a mvexpand in there to create 4 rows each with ts own token value before you take to pie chart...</P> <PRE><CODE> ... (Your 1st 4 evals) ... | eval a=mvzip(token1,token2) | eval b=mvzip(token3,token4) | eval allTokens=mvzip(a,b) | mvexpand allTokens | eval count=allTokens | stats count by allTokens </CODE></PRE> Thu, 13 Oct 2016 23:11:08 GMT https://community.splunk.com/t5/Dashboards-Visualizations/How-to-create-a-pie-chart-of-percentages-out-of-just-numeric/m-p/254127#M15885 jkat54 2016-10-13T23:11:08Z https://community.splunk.com/t5/Dashboards-Visualizations/How-to-create-a-pie-chart-of-percentages-out-of-just-numeric/m-p/254128#M15886 <P>You may be able to skip the first 4 evals if you use the tokens in the mvzips instead</P> Thu, 13 Oct 2016 23:16:43 GMT https://community.splunk.com/t5/Dashboards-Visualizations/How-to-create-a-pie-chart-of-percentages-out-of-just-numeric/m-p/254128#M15886 jkat54 2016-10-13T23:16:43Z https://community.splunk.com/t5/Dashboards-Visualizations/How-to-create-a-pie-chart-of-percentages-out-of-just-numeric/m-p/254129#M15887 <P>Its giving me a piechart with a single color and single label "token1,token2,token2..."</P> Thu, 13 Oct 2016 23:44:21 GMT https://community.splunk.com/t5/Dashboards-Visualizations/How-to-create-a-pie-chart-of-percentages-out-of-just-numeric/m-p/254129#M15887 smhsplunk 2016-10-13T23:44:21Z https://community.splunk.com/t5/Dashboards-Visualizations/How-to-create-a-pie-chart-of-percentages-out-of-just-numeric/m-p/254130#M15888 <P>What search did you end up with?</P> Fri, 14 Oct 2016 01:11:11 GMT https://community.splunk.com/t5/Dashboards-Visualizations/How-to-create-a-pie-chart-of-percentages-out-of-just-numeric/m-p/254130#M15888 jkat54 2016-10-14T01:11:11Z https://community.splunk.com/t5/Dashboards-Visualizations/How-to-create-a-pie-chart-of-percentages-out-of-just-numeric/m-p/254131#M15889 <P>Wait, what value is supposed to fill the pieces of the pie and what label should label the pie pieces?</P> <P>Your providing one value for each field via the token. I assume you want that as the value/count. So then token1, token2, token3, and token4 should be the labels?</P> Fri, 14 Oct 2016 01:25:19 GMT https://community.splunk.com/t5/Dashboards-Visualizations/How-to-create-a-pie-chart-of-percentages-out-of-just-numeric/m-p/254131#M15889 jkat54 2016-10-14T01:25:19Z https://community.splunk.com/t5/Dashboards-Visualizations/How-to-create-a-pie-chart-of-percentages-out-of-just-numeric/m-p/254132#M15890 <P>Maybe this:</P> <PRE><CODE> index=main host="*" | eval token1="$token1$"| eval token2="$token2$"| eval token3="$token3$"| eval token4 = "$token4$"| chart values(token*) by token* </CODE></PRE> Fri, 14 Oct 2016 01:28:17 GMT https://community.splunk.com/t5/Dashboards-Visualizations/How-to-create-a-pie-chart-of-percentages-out-of-just-numeric/m-p/254132#M15890 jkat54 2016-10-14T01:28:17Z https://community.splunk.com/t5/Dashboards-Visualizations/How-to-create-a-pie-chart-of-percentages-out-of-just-numeric/m-p/254133#M15891 <P>Please see this simplified example (this doesnt work)</P> <PRE><CODE>index=main host="*" | eval token1=10 | eval token2=20 | eval token3=30 | stats values(token*) by token* </CODE></PRE> <P>so I would like the piechart to have labels 10 (20% slice), 20 (40% slice) and 30 (60% slice)<BR /> The correct slices are more important than labels i guess..</P> Fri, 14 Oct 2016 14:09:05 GMT https://community.splunk.com/t5/Dashboards-Visualizations/How-to-create-a-pie-chart-of-percentages-out-of-just-numeric/m-p/254133#M15891 smhsplunk 2016-10-14T14:09:05Z https://community.splunk.com/t5/Dashboards-Visualizations/How-to-create-a-pie-chart-of-percentages-out-of-just-numeric/m-p/254134#M15892 <P>I think something like this would work (first line is just to generate a single row where token fields can be created)</P> <P><STRONG>Updated</STRONG></P> <PRE><CODE>| gentimes start=-1 | eval token1="$token1$" | eval token2="$token2$" | eval token3="$token3$" | eval token4 = "$token4$" | table token* | eval token=1 | untable token tokens value | table tokens value </CODE></PRE> Fri, 14 Oct 2016 14:55:20 GMT https://community.splunk.com/t5/Dashboards-Visualizations/How-to-create-a-pie-chart-of-percentages-out-of-just-numeric/m-p/254134#M15892 somesoni2 2016-10-14T14:55:20Z https://community.splunk.com/t5/Dashboards-Visualizations/How-to-create-a-pie-chart-of-percentages-out-of-just-numeric/m-p/254135#M15893 <P>This again gives me a table with all values, but when I try to convert it into a piechart using visualization it shows a single color for the entire piechart (currently it shows)</P> <P>token0: 0 <BR /> token1: 55%<BR /> token1%: 100%</P> <P>I don't have pie slices per tokens</P> Fri, 14 Oct 2016 15:15:35 GMT https://community.splunk.com/t5/Dashboards-Visualizations/How-to-create-a-pie-chart-of-percentages-out-of-just-numeric/m-p/254135#M15893 smhsplunk 2016-10-14T15:15:35Z https://community.splunk.com/t5/Dashboards-Visualizations/How-to-create-a-pie-chart-of-percentages-out-of-just-numeric/m-p/254136#M15894 <P>Try updated answer.</P> Fri, 14 Oct 2016 15:30:57 GMT https://community.splunk.com/t5/Dashboards-Visualizations/How-to-create-a-pie-chart-of-percentages-out-of-just-numeric/m-p/254136#M15894 somesoni2 2016-10-14T15:30:57Z https://community.splunk.com/t5/Dashboards-Visualizations/How-to-create-a-pie-chart-of-percentages-out-of-just-numeric/m-p/254137#M15895 <P>This is great, this works, last question is it possible to change the token names after the last line, I tried to do but it retains the old token labels as token1, token2... </P> Fri, 14 Oct 2016 15:54:59 GMT https://community.splunk.com/t5/Dashboards-Visualizations/How-to-create-a-pie-chart-of-percentages-out-of-just-numeric/m-p/254137#M15895 smhsplunk 2016-10-14T15:54:59Z https://community.splunk.com/t5/Dashboards-Visualizations/How-to-create-a-pie-chart-of-percentages-out-of-just-numeric/m-p/254138#M15896 <P>What do you want it to be changed as? I guess you can just create the field with the name you want at the first place and you should be good (update token name in eval and table command)</P> Fri, 14 Oct 2016 16:08:31 GMT https://community.splunk.com/t5/Dashboards-Visualizations/How-to-create-a-pie-chart-of-percentages-out-of-just-numeric/m-p/254138#M15896 somesoni2 2016-10-14T16:08:31Z https://community.splunk.com/t5/Dashboards-Visualizations/How-to-create-a-pie-chart-of-percentages-out-of-just-numeric/m-p/254139#M15897 <P>yup thanks!</P> Fri, 14 Oct 2016 17:18:51 GMT https://community.splunk.com/t5/Dashboards-Visualizations/How-to-create-a-pie-chart-of-percentages-out-of-just-numeric/m-p/254139#M15897 smhsplunk 2016-10-14T17:18:51Z