topic Re: Pie chart for 2 fields in Splunk Search

How to create pie chart for two fields?

Dharani — Tue, 04 Apr 2023 10:35:01 GMT

Hi,

I have service name verb, object and outcome. I need to show the statistics in pie chart.

For example,

index=abc (SUBJECT="Access" AND OBJECT="status" AND VERB="Get") OR (SUBJECT="Customer Service" AND VERB=Get AND OBJECT="Customer status") OR (SUBJECT="Agreement service" AND OBJECT="attachments" AND VERB="Create")
| search OUTCOME=FAILURE
| chart count by VERB,OBJECT

Results:

VERB Customer status attachments

Get 3 0

Create 0 2

What I am looking for is to show that 2 failures for create attachments and 3 failures for get customer status in Pie Chart format. But above query is not working like that , it is only showing one field in the pie chart which is not use ful.

Please help on this.

Thanks in Advance.

Re: Pie chart for 2 fields

yuanliu — Mon, 03 Apr 2023 15:22:36 GMT

By definition, pie chart visualizes a one-dimensional function. When you use two fields in groupby, that creates a two-dimensional function. Drop OBJECT.

The caveat is that you must have positive knowledge that OBJECT and VERB are diagonal as your illustrated data show. Otherwise you need to assess whether the results still suite your need.

Hope this helps.

Re: Pie chart for 2 fields

Dharani — Tue, 04 Apr 2023 06:08:06 GMT

Hi,

Thanks for this , but only having VERB in pie chart will not help for my case.

Is there any possibility to join VERB and OBJECT to a single field and make that field in chart command.

Example,

VERB=get OBJECT=customer status

new_field="get customer status"

IN query:

chart count by new_field.

Please let me know if this is possible.

Thanks!

Re: Pie chart for 2 fields

yuanliu — Tue, 04 Apr 2023 07:26:27 GMT

Yes, string concatenation can be used to flatten a vector when data are not strictly diagonal.

index=abc (SUBJECT="Access" AND OBJECT="status" AND VERB="Get") OR (SUBJECT="Customer Service" AND VERB=Get AND OBJECT="Customer status") OR (SUBJECT="Agreement service" AND OBJECT="attachments" AND VERB="Create") | search OUTCOME=FAILURE | eval verb_object = VERB . " " . OBJECT | chart count by verb_object

Re: Pie chart for 2 fields

Dharani — Tue, 04 Apr 2023 10:57:10 GMT

Thanks it works