topic Re: Pie chart using 2 inputlookup files in Splunk Search

Pie chart using 2 inputlookup files

marceloalejandr — Fri, 10 Dec 2021 14:50:09 GMT

Aloha,

We’ve a reporting requirement to create a Pie chart using 2 input files. So far we’ve successfully created Bar charts with inputlookup files.

Could you please advise the best way to create a Pie chart using 2 inputlookup files?

Thanks in advance.

Re: Pie chart using 2 inputlookup files

richgalloway — Fri, 10 Dec 2021 15:02:26 GMT

The number of inputs is irrelevant. A pie chart just needs a single data series produced using something like this:

| stats count by foo

Re: Pie chart using 2 inputlookup files

ITWhisperer — Fri, 10 Dec 2021 15:10:10 GMT

There is a trellis option on pie charts so you can have multiple data series with each pie chart showing one of the series.

| stats count by foo bar | xyseries foo bar count

Re: Pie chart using 2 inputlookup files

marceloalejandr — Fri, 10 Dec 2021 15:18:51 GMT

Rich,

Thanks for your message. Currently we're able to show separate Bar charts for 2 inputlookup files. Here's a sample of the SPL:
| inputlookup blank.csv
| appendcols [| inputlookup ServiceAccountsInOU.csv | stats count AS "Service Accounts in OU" ]
| appendcols [| inputlookup ServiceAccountsNotInOU.csv | stats count AS "Service Accounts NOT in OU"]

How would we implement your suggestion? Thanks.

Re: Pie chart using 2 inputlookup files

marceloalejandr — Fri, 10 Dec 2021 15:33:51 GMT

Both inputlookup files have one and the same field name (sAMAccountName) containing user accounts. What's the inputlookup SPL to reference both files? Thanks again.

Re: Pie chart using 2 inputlookup files

marceloalejandr — Fri, 10 Dec 2021 15:40:21 GMT

Both inputlookup files have one and the same field name (sAMAccountName) containing user accounts. What's the inputlookup SPL to reference both files? Thanks again.

Re: Pie chart using 2 inputlookup files

ITWhisperer — Fri, 10 Dec 2021 15:47:19 GMT

What are you trying to show with your pie charts because the inputlookup and stats command in each of the appendcols will only return one event each so a pie chart of each series will have 100%

Re: Pie chart using 2 inputlookup files

marceloalejandr — Fri, 10 Dec 2021 16:06:27 GMT

Each file contains a number of users and each file will have a count. The Pie chart should include the total count of both files and then the percentages of each file's count against the total. How do we combine the files to get the total and then show the percentage of each file's count against the total?

Re: Pie chart using 2 inputlookup files

richgalloway — Fri, 10 Dec 2021 16:15:10 GMT

A pie chart requires a single data series, whereas the current query has two. The pie chart will display the first series (field) as 100%.

Here's an alternative query that should work:

Re: Pie chart using 2 inputlookup files

marceloalejandr — Fri, 10 Dec 2021 16:26:20 GMT

That's awesome! Thanks!!!