topic Re: help for doing a pie chart from 2 subsearch in Splunk Search

help for doing a pie chart from 2 subsearch

jip31 — Fri, 27 Sep 2019 14:37:26 GMT

I have the search below

`test` 
    [| inputlookup host.csv 
    | table host 
    | rename host as USERNAME ] 
| lookup aps.csv NAME as AP_NAME OUTPUT Building  
| lookup cmdb.csv HOSTNAME as USERNAME output BUILDING_DESCRIPTION
| stats last(Building) as BuildingAP, last(BUILDING_DESCRIPTION) as BuildingIT

What I need is to do a pie chart in order to have the percentage of the events where BuildingAP doesnt match with BuildingIT
So first, I have to write this where condition
After I need to count the number of events corresponding to this where condition and to count also the total number of events (events without the where condition) in order to have 2 news fields which allows doing a pie chart
but pearhaps there is another solution?
For summarize I need a pie chart with 2 label in %, one which calculate the % of events where BuildingAP is not equal to BuildingIT and another which is the equal tio the total % of events - the % the previous count
Is anybody cant help me please??

Re: help for doing a pie chart from 2 subsearch

diogofgm — Fri, 27 Sep 2019 14:51:58 GMT

Try something like this and change according to what you are trying to compare:

 `test` 
     [| inputlookup host.csv 
     | table host 
     | rename host as USERNAME ] 
| lookup aps.csv NAME as AP_NAME OUTPUT Building  
| lookup cmdb.csv HOSTNAME as USERNAME output BUILDING_DESCRIPTION
| eval isEqual = case(Building = BUILDING_DESCRIPTION,"true","false")
| stats count by isEqual

Re: help for doing a pie chart from 2 subsearch

gcusello — Fri, 27 Sep 2019 15:23:16 GMT

Hi jip31,
Try something like this:

`test` 
 [ | inputlookup host.csv 
   | table host 
   | rename host as USERNAME ] 
| lookup aps.csv NAME as AP_NAME OUTPUT Building  
| lookup cmdb.csv HOSTNAME as USERNAME output BUILDING_DESCRIPTION
| search NOT (Building = BUILDING_DESCRIPTION)
| stats count

Bye.
Giuseppe

Re: help for doing a pie chart from 2 subsearch

jip31 — Mon, 30 Sep 2019 06:43:47 GMT

Hi
it doesnt works
I have the message " Error in 'eval' command: The arguments to the 'case' function are invalid."

Re: help for doing a pie chart from 2 subsearch

jip31 — Mon, 30 Sep 2019 06:46:40 GMT

Hi
I have no results (pie empty only....)

Re: help for doing a pie chart from 2 subsearch

jip31 — Tue, 01 Oct 2019 05:58:24 GMT

Is anybody has an idea please??

Re: help for doing a pie chart from 2 subsearch

jip31 — Wed, 02 Oct 2019 05:05:55 GMT

Ii there somebody for helping me please??

Re: help for doing a pie chart from 2 subsearch

diogofgm — Sun, 06 Oct 2019 22:58:29 GMT

can you try again? there was a typo on the case arguments (missing ")