topic Re: Creating Pie Chart with three separate fields and their percentage value in Dashboards & Visualizations

Creating Pie Chart with three separate fields and their percentage value

P_raju — Thu, 28 Oct 2021 11:12:30 GMT

Hi All,

I need to build pie chart for three separate fields which should display the field name and its percentage in the same pie chart.

Eg: ial1, ial2 and ial3 are three different fields in Splunk. It should display in the attached format. Could someone help me on this.

Re: Creating Pie Chart with three separate fields and their percentage value

jhanvidattani — Tue, 02 Nov 2021 11:30:31 GMT

@P_raju

You can use fieldsummary command to do this. Example:

index="_internal"| fieldsummary | table field, distinct_count

If you find my solution/debugging steps fruitful, an upvote would be appreciated.

Re: Creating Pie Chart with three separate fields and their percentage value

ITWhisperer — Tue, 02 Nov 2021 11:59:14 GMT

the standard pie chart doesn't display percentages except when you hover over the various segments. Is this sufficient? If so, you just need a table with id and count(?) and visualise that as a pie chart e.g.

| stats count by id

Re: Creating Pie Chart with three separate fields and their percentage value

P_raju — Tue, 02 Nov 2021 18:52:56 GMT

Hi,

In Splunk, the fields are distinct as attached. Let me know how to combine these fields into single field so that i can create pie chart.

Regards,

P_raju

Re: Creating Pie Chart with three separate fields and their percentage value

ITWhisperer — Tue, 02 Nov 2021 19:23:01 GMT

I have assumed you want to count the ia* fields - if you want something else, change the stats function - the key is to then transpose to get each ia* value as a different event

| gentimes start=-1 increment=10m | eval id="ia".(random()%3)."_users" | table id | eval {id}=random()%10 | fields - id | stats count(ia*_users) as ia*_users | transpose 0

Re: Creating Pie Chart with three separate fields and their percentage value

jhanvidattani — Wed, 03 Nov 2021 05:47:09 GMT

You can try it as:

index<your_index> | fields ia_*| fieldsummary | table field, distinct_count

Pie chart will create sections depending on count of each field and calculate percentage by default (visible by hovering on each segment).