https://community.splunk.com/t5/Dashboards-Visualizations/Hi-I-want-to-show-the-data-in-pie-chart-based-on-the-different/m-p/465006#M30531 <P>Please explain how the new query is not working. What results do you expect and what results do you get?</P> <P>The <CODE>case</CODE> function returns the first matching expression. If an event contains both message="test data order"' and 'path=/test/orders' then result will be set to "Order Data".</P> Tue, 26 May 2020 12:42:01 GMT richgalloway 2020-05-26T12:42:01Z https://community.splunk.com/t5/Dashboards-Visualizations/Hi-I-want-to-show-the-data-in-pie-chart-based-on-the-different/m-p/465005#M30530 <P>Hi All,<BR />Currently I have below query which works fine for pie-chart for 3 different data , which is working fine.</P> <PRE><CODE>"*test-path*" | bucket span=1d _time | rename test-path as path | eval result=case((path == "/test/orders"), "Order Data" , (path == "/test-data/orders"), "test order" , (path == "/test2-data2/orders/"), "Test data") | chart count by result | eval result = count + " " + result | fields result, count </CODE></PRE> <P>but i want to extend it by adding 1 more search "test data for order - path" which is coming in the <STRONG>message</STRONG> key, I have tried below but not working:</P> <PRE><CODE>"*test-path*" | bucket span=1d _time | rename test-path as path | **rename message as msg** | eval result=case((path == "/test/orders"), "Order Data" , (path == "/test-data/orders"), "test order" , (path == "/test2-data2/orders/"), "Test data" , (**msg == "*test data for order - path***"), "test data order") | chart count by result | eval result = count + " " + result | fields result, count </CODE></PRE> <P>Can anyone plz help.</P> Sun, 07 Jun 2020 23:50:47 GMT https://community.splunk.com/t5/Dashboards-Visualizations/Hi-I-want-to-show-the-data-in-pie-chart-based-on-the-different/m-p/465005#M30530 neha_h 2020-06-07T23:50:47Z https://community.splunk.com/t5/Dashboards-Visualizations/Hi-I-want-to-show-the-data-in-pie-chart-based-on-the-different/m-p/465006#M30531 <P>Please explain how the new query is not working. What results do you expect and what results do you get?</P> <P>The <CODE>case</CODE> function returns the first matching expression. If an event contains both message="test data order"' and 'path=/test/orders' then result will be set to "Order Data".</P> Tue, 26 May 2020 12:42:01 GMT https://community.splunk.com/t5/Dashboards-Visualizations/Hi-I-want-to-show-the-data-in-pie-chart-based-on-the-different/m-p/465006#M30531 richgalloway 2020-05-26T12:42:01Z https://community.splunk.com/t5/Dashboards-Visualizations/Hi-I-want-to-show-the-data-in-pie-chart-based-on-the-different/m-p/465007#M30532 <P>@richgalloway , <BR /> this is my raw splunk events:-<BR /> message: Source :undefined, test Id :"76767676-ef2c-4bec-454-666111598873", <STRONG>msg</STRONG> : test data for order - path<BR /> extras-path: /test-data/orders<BR /> extras-path: /test/orders<BR /> so i can evaluate path with above query but not sure how to evaluate msg (since msg is inside message) and display it's count in the same pie-chart</P> Fri, 29 May 2020 09:27:32 GMT https://community.splunk.com/t5/Dashboards-Visualizations/Hi-I-want-to-show-the-data-in-pie-chart-based-on-the-different/m-p/465007#M30532 neha_h 2020-05-29T09:27:32Z https://community.splunk.com/t5/Dashboards-Visualizations/Hi-I-want-to-show-the-data-in-pie-chart-based-on-the-different/m-p/465008#M30533 <P>Thank you for sharing the sample event. You still haven't described your expected and actual results.<BR /> Please run this query to verify the fields are as expected.</P> <PRE><CODE>"*test-path*" | bucket span=1d _time | rename test-path as path | rename message as msg | table path msg </CODE></PRE> Fri, 29 May 2020 12:54:48 GMT https://community.splunk.com/t5/Dashboards-Visualizations/Hi-I-want-to-show-the-data-in-pie-chart-based-on-the-different/m-p/465008#M30533 richgalloway 2020-05-29T12:54:48Z