topic Charting 2 different stats query in Dashboards & Visualizations

Charting 2 different stats query

RonD — Tue, 15 Dec 2020 19:59:15 GMT

I am trying to achieve a simple pie chart that will display from two different stats query command

| inputlookup records.csv where condition1=compliant | stats count(host) as compliant
| append records.csv where (condition2=noncompliant AND condition3=noncompliant and condition4=noncompliant)| stats count(host) as noncompliant
| <I am missing a command at this point in able to produce the pie chart below>

Please advise. Thanks and regards.

Re: Charting 2 different stats query

s2_splunk — Tue, 15 Dec 2020 21:08:31 GMT

Here's one approach:

| inputlookup records.csv | eval status=if( (condition1="noncompliant") OR (condition2="noncompliant" AND condition3="noncompliant" AND condition4="noncompliant"),"NC","C") | stats count(host) by status

BTW, you don't need a

stats count(host)

because you are just counting records, so

stats count

would also work.

Re: Charting 2 different stats query

RonD — Tue, 15 Dec 2020 21:14:12 GMT

Thanks, this worked.