topic Re: piechart in Splunk Search

piechart

avneet26 — Thu, 12 Nov 2020 09:38:23 GMT

I want to create two pie chart each based upon the value of index I am choosing. using below two queries

1. index = index1 host=.......| ...

2. index=index2 host=....|

then i want to include both of these pie charts into the same report so that I can send them as alert in the same mail. How can I do that ? tried append and multi search but didnt help.

Re: piechart

ITWhisperer — Thu, 12 Nov 2020 10:04:00 GMT

Can you be a bit more specific about what you tried and why it didn't work? Append and multiple searches sound like they would normally solve the problem, so without further information, it is difficult to advise.

Re: piechart

avneet26 — Thu, 12 Nov 2020 10:27:38 GMT

this didnt work for me

Re: piechart

ITWhisperer — Thu, 12 Nov 2020 10:36:11 GMT

In what way didn't it work? No result? Incorrect results? host missing?

Are these event similar, just in different indexes? Can you use:

search index=index1 OR index=index2 host=* source=*logs* username sourcetype=* | rex "user\":\"(?<user>[^\"]+)" | stats count by user

| stats values(index) as index count by user

| stats count by user index

Re: piechart

avneet26 — Thu, 12 Nov 2020 10:40:37 GMT

it didnt give any results. my concern is how can I generate two different pie charts using these two searches and those two pie charts should be different based on index values(one for index1 other for index2)

Re: piechart

ITWhisperer — Thu, 12 Nov 2020 10:48:25 GMT

Sorry, I misunderstood, I thought you were trying to use two indexes in the same chart. The chart is a visualisation of the results of a query. I don't think there is a standard pie chart visualisation that produces multiple charts. Perhaps you should submit this as an improvement request.