https://community.splunk.com/t5/Splunk-Search/Pie-chart-merging-two-sources/m-p/533785#M150845 <UL><LI>Use the lookup to store desired list of servers</LI><LI>Search for events where the patching is complete</LI><LI>Compare the servers in the event against the lookup entries</LI></UL><P>Here is a run anywhere example</P><LI-CODE lang="markup">|makeresults|eval country="Germany Australia"|makemv country|mvexpand country |stats count by country |inputlookup geo_attr_countries.csv append=true |fillnull count value=0 |stats sum(count) as count by country</LI-CODE><P>Here those countries which are in the events (makeresults) will have a count 1 and others 0. In your case, you may use it to differentiate between patched and unpatched and then find %</P> Tue, 22 Dec 2020 03:05:59 GMT renjith_nair 2020-12-22T03:05:59Z https://community.splunk.com/t5/Splunk-Search/Pie-chart-merging-two-sources/m-p/533756#M150834 <P>I have a table that shows the number of missing patches for our servers. I am trying to create a pie chart that will show what % of all of our servers are missing patches. I have tried entering a lookup file that has a list of all our servers, and also added another sourcetype with that same list. I can't seems to figure out how I can combine the two so I can view the list of servers that need a patch against the total list of servers we have.</P> Mon, 21 Dec 2020 18:34:01 GMT https://community.splunk.com/t5/Splunk-Search/Pie-chart-merging-two-sources/m-p/533756#M150834 avgilbeyzz 2020-12-21T18:34:01Z https://community.splunk.com/t5/Splunk-Search/Pie-chart-merging-two-sources/m-p/533785#M150845 <UL><LI>Use the lookup to store desired list of servers</LI><LI>Search for events where the patching is complete</LI><LI>Compare the servers in the event against the lookup entries</LI></UL><P>Here is a run anywhere example</P><LI-CODE lang="markup">|makeresults|eval country="Germany Australia"|makemv country|mvexpand country |stats count by country |inputlookup geo_attr_countries.csv append=true |fillnull count value=0 |stats sum(count) as count by country</LI-CODE><P>Here those countries which are in the events (makeresults) will have a count 1 and others 0. In your case, you may use it to differentiate between patched and unpatched and then find %</P> Tue, 22 Dec 2020 03:05:59 GMT https://community.splunk.com/t5/Splunk-Search/Pie-chart-merging-two-sources/m-p/533785#M150845 renjith_nair 2020-12-22T03:05:59Z