https://community.splunk.com/t5/Splunk-Search/pie-chart/m-p/541936#M153478 <LI-CODE lang="markup">| stats sum(errors) as errortotal by host | eval status=if(errortotal &gt; 50,"unsuccessful", "successful") | stats count by status</LI-CODE> Tue, 02 Mar 2021 10:42:56 GMT ITWhisperer 2021-03-02T10:42:56Z https://community.splunk.com/t5/Splunk-Search/pie-chart/m-p/541927#M153474 <P>Hi,</P><P>I got a splunk search that monitors, how many different hosts there were in the chosen timespan.&nbsp;</P><LI-CODE lang="markup">| stats dc(host) as hostcount</LI-CODE><P>Now I would like to generate a pie chart, that compares succesful hosts with the unseccesful ones. Therefore I got a field "errors". All hosts with error &gt; 50 should be counted as unseccesful. The others should be counted as succesful. The pie chart should show the succesful/unsuccesful ratio.&nbsp;</P> Tue, 02 Mar 2021 10:12:25 GMT https://community.splunk.com/t5/Splunk-Search/pie-chart/m-p/541927#M153474 schufi01 2021-03-02T10:12:25Z https://community.splunk.com/t5/Splunk-Search/pie-chart/m-p/541936#M153478 <LI-CODE lang="markup">| stats sum(errors) as errortotal by host | eval status=if(errortotal &gt; 50,"unsuccessful", "successful") | stats count by status</LI-CODE> Tue, 02 Mar 2021 10:42:56 GMT https://community.splunk.com/t5/Splunk-Search/pie-chart/m-p/541936#M153478 ITWhisperer 2021-03-02T10:42:56Z https://community.splunk.com/t5/Splunk-Search/pie-chart/m-p/541940#M153480 <P>Thank you, that already helps. However I did a mistake while explaining my situation. I dont want the sum of errors to be&nbsp; &gt; 50. If there was one event with error &gt;50 within the timespan, the host should be classified unsuccesful. The sum of errors per host is not important for me. Only if there was one single event with error &gt;50. Do you understand what I mean?</P> Tue, 02 Mar 2021 10:53:27 GMT https://community.splunk.com/t5/Splunk-Search/pie-chart/m-p/541940#M153480 schufi01 2021-03-02T10:53:27Z https://community.splunk.com/t5/Splunk-Search/pie-chart/m-p/541947#M153482 <LI-CODE lang="markup">| makeresults | eval _raw="host errors abc def 50 ghi 51 abc 2 def 50 ghi 51" | multikv forceheader=1 | fields - _raw _time linecount | eval unsuccessful = if(errors &gt; 50, "unsuccessful", null) | stats values(unsuccessful) as unsuccessful by host | eval status=if(unsuccessful = "unsuccessful","unsuccessful", "successful") | stats count by status</LI-CODE> Tue, 02 Mar 2021 11:21:11 GMT https://community.splunk.com/t5/Splunk-Search/pie-chart/m-p/541947#M153482 ITWhisperer 2021-03-02T11:21:11Z