topic plotting using data across multiple indexes in Dashboards & Visualizations

plotting using data across multiple indexes

nekbote — Mon, 06 Apr 2015 22:56:18 GMT

index=index1 | stats sum(feild1) as totalAmount1
index=index 2| stats sum(feild2) as totalAmount2
index=index 3| stats sum(feild3) as totalAmount3

I need to display data from above 3 searches in the form of pie chart. Each pie section corresponds to each of the totals

piechart=piesection1 should correspond to totalAmount1 +
piesection2 should correspond to totalAmount2 +
piesection3 should correspond to totalAmount3

Can you please guide me as to how this can be performed.

Please note the filed1,field2 & field3 are not common across indexes each of those represent order amount for that index.

Can you guide me as to how this can be achieved

thanks!

Re: plotting using data across multiple indexes

aljohnson_splun — Mon, 06 Apr 2015 23:12:03 GMT

Try something like this:

index=index1 OR index=index2 OR index=index3
| fields field1, field2, field3, index
| eval grouped_fields = coalesce(field1, field2, field3)
| chart sum(grouped_fields) by index

Then just go to the visualization drop down and select the pie.

So what's actually happening ? Rather than thinking about this as three seperate searches, we go ahead and specify all the indexes we might search for and all the fields we are interested in the first two lines:

index=index1 OR index=index2 OR index=index3
| fields field1, field2, field3, index

Next, we use eval to push all those fields into one field. Now this seems counterintuitive but the reason that it works is because we can still use their values for the index field to keep them distinct. Grouping them together just allows us to push them all into the same sum() function. coalesce() here is taking any number of arguments and returning the whichever is not null.

| eval grouped_fields = coalesce(field1, field2, field3)

Lastly, you can use chart (or stats if you want) to get the sum, splitting by index. One last thing you could do, would be rename the indexes to what ever they might be representing.

Re: plotting using data across multiple indexes

nekbote — Mon, 06 Apr 2015 23:23:46 GMT

@ aljohnson_splunk---Thanks alot for the quick response and it worked like a charm, i have been trying it out all day and your direction solved it in a minute...thank you again!!