topic Re: Could you help me link a pie chart with an input token? in Dashboards & Visualizations

Could you help me link a pie chart with an input token?

jip31 — Mon, 05 Nov 2018 13:29:19 GMT

hello

I use the code below for doing a pie chart

index=windows sourcetype="wineventlog:system" SourceName="Disk" EventCode=7 Type="Critique" 
| dedup _time 
| stats count by EventCode
| eventstats sum(count) as Total 
| eval percent=round((count/Total)*100,1) 
| eval EventCode=EventCode."(count: ".count.", percent: ".percent.")"

I need to update automatically this pie chart from an input token which represents the hostname.

I have something like this, but it doesn't work.

| stats count by EventCode, host

have you an idea please???

Re: Could you help me link a pie chart with an input token?

jip31 — Tue, 06 Nov 2018 07:49:45 GMT

Nobody can't help me please??

Re: Could you help me link a pie chart with an input token?

renjith_nair — Tue, 06 Nov 2018 08:45:58 GMT

@jip31,

if you just want to filter based on the host name from the token, then try adding this to your base search.

     index=windows sourcetype="wineventlog:system" SourceName="Disk" EventCode=7 Type="Critique"  host=$hostname$

Re: Could you help me link a pie chart with an input token?

jip31 — Fri, 09 Nov 2018 10:45:10 GMT

hi it's what i m doing but when i m doing this in my report I cant have any results....

Re: Could you help me link a pie chart with an input token?

renjith_nair — Fri, 09 Nov 2018 12:00:43 GMT

Try one of the hostnames which is a candidate for $hostname$ and search in search window and see if it returns

Re: Could you help me link a pie chart with an input token?

jip31 — Mon, 12 Nov 2018 14:00:52 GMT

pearhaps I have bad explained
my token works with * or with an exact host
but i would like to have no pie chart if a wrong host is entered in the token
even with a wrong host actually my pie chart is always displayed....