topic How to make a piechart with 2 different "values" 1 "value" is all the "= 0" in green, and the rest in red? in Splunk Search

How to make a piechart with 2 different "values" 1 "value" is all the "= 0" in green, and the rest in red?

michaelnorup — Thu, 17 Feb 2022 16:10:06 GMT

index="***********" sourcetype="**********" (host="*") | rex field=_raw "(Available Updates)\s+(?<AvailableUpdates>.+)" | table _time _raw host AvailableUpdates | stats latest(AvailableUpdates) as AvailableUpdates by host

Hey guys.

So I have a search that gives a table as such:

Host __________________ AvailableUpdates

Host1_________________ = 21
Host2__________________= 0
Host3__________________= 5
Host4__________________= 0
Host5__________________ null

I am looking to make a piechart with 2 different "values"
1 "value" is all the "= 0" in green, and the rest in red.

Can't quite figure out how to sort this.

Tyvm

Re: Piechart with nonnumeric values

michaelnorup — Thu, 17 Feb 2022 10:54:07 GMT

Ok, so i changed the search to

index="******" sourcetype="**********" (host="*") | rex field=_raw "(Available Updates)\s+(?<AvailableUpdates>.+)" | table _time _raw host AvailableUpdates | stats count by AvailableUpdates | chart count by AvailableUpdates

Now i would like to group it in to just 2 groups as stated above instead of the 4 groups as now

Re: Piechart with nonnumeric values

ITWhisperer — Thu, 17 Feb 2022 12:18:02 GMT

Do you mean something like this?

Re: Piechart with nonnumeric values

michaelnorup — Thu, 17 Feb 2022 11:30:34 GMT

Yea that almost did the trick thanks,

Think you could remove the index and sourcetype from your reply?

Also, can i have more than 1 value in the eval status=if(value1=something AND value2=something etc) ?

It didnt actually color the chart correctly though. Also is there a way to get the actual count to show inside the chart aswell? 🙂

Re: Piechart with nonnumeric values

ITWhisperer — Thu, 17 Feb 2022 12:40:25 GMT

You can use the charting option