Unable to Chart Numeric Fields from Single Event

Joshua — Mon, 28 Sep 2020 09:28:30 GMT

I've been really struggling with what seemed at first very simple is proving impossible, any help on this would be great.

I have a one event which is extracting three numerical values which I want correlated within a Pie chart. However no matter the reporting format I choose it will only ever display one value in the charts i.e. due to being only one event.

Event Example

<Report timestamp="2011-04-20 03:31:12.035">
    <Status count="54" name="RUNNING"/>
    <Status count="53" name="NOTDEPLOYED"/>
    <Status count="1" name="UNKNOWN"/>
  </Report>

I then have field extractions in my props.conf to give me the values from each count so if I was too search "sourcetype="TIBCO_EMS_SAF" | table, RunningCount, NotDeployedCount, UNKNOWN"

RunningCount = 54
NotDeployedCount = 53
UNKNOWN = 1

So all I need is those fields/values from a single event in a Pie Chart against each other.

Any suggestions would be great.

Thanks,

Joshua

Re: Unable to Chart Numeric Fields from Single Event

Ayn — Wed, 20 Apr 2011 10:01:33 GMT

Use transpose:

sourcetype="TIBCO_EMS_SAF" 
| table RunningCount, NotDeployedCount, UNKNOWN
| transpose

This transposes the table so that each field gets its own row, which you can then use as source data for your pie chart.

Re: Unable to Chart Numeric Fields from Single Event

Joshua — Wed, 20 Apr 2011 10:11:18 GMT

This worked thanks!

topic Re: Unable to Chart Numeric Fields from Single Event in Dashboards & Visualizations

Unable to Chart Numeric Fields from Single Event

Re: Unable to Chart Numeric Fields from Single Event

Re: Unable to Chart Numeric Fields from Single Event