https://community.splunk.com/t5/Splunk-Search/How-to-include-the-country-in-the-PIE-chart/m-p/682940#M233270 <P><SPAN>Create a composite field with the two labels concatenated and count by that</SPAN></P><P><SPAN>I am not sure how to create composite filed, could you please advice on this please</SPAN></P><P>&nbsp;</P> Wed, 03 Apr 2024 03:06:45 GMT jaibalaraman 2024-04-03T03:06:45Z https://community.splunk.com/t5/Splunk-Search/How-to-include-the-country-in-the-PIE-chart/m-p/682912#M233255 <P>Hi&nbsp;</P><P>Can anyone help me with below query&nbsp;</P><P>I have created a pie chart based on the error message, however i am not sure how to add country along&nbsp;</P><P>index=test<BR />| iplocation Properties.ip<BR />| dedup Properties.ip<BR />| stats count by event.Properties.errMessage</P><P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="jaibalaraman_0-1712097532525.png" style="width: 400px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/30136iEC4F28F4512E72FF/image-size/medium?v=v2&amp;px=400" role="button" title="jaibalaraman_0-1712097532525.png" alt="jaibalaraman_0-1712097532525.png" /></span></P><P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="jaibalaraman_1-1712097568683.png" style="width: 400px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/30137i0778C7C86B7EA582/image-size/medium?v=v2&amp;px=400" role="button" title="jaibalaraman_1-1712097568683.png" alt="jaibalaraman_1-1712097568683.png" /></span></P><P>&nbsp;</P><P>&nbsp;</P><P>&nbsp;</P><P>&nbsp;</P> Tue, 02 Apr 2024 22:39:52 GMT https://community.splunk.com/t5/Splunk-Search/How-to-include-the-country-in-the-PIE-chart/m-p/682912#M233255 jaibalaraman 2024-04-02T22:39:52Z https://community.splunk.com/t5/Splunk-Search/How-to-include-the-country-in-the-PIE-chart/m-p/682918#M233258 <P>Create a composite field with the two labels concatenated and count by that</P> Tue, 02 Apr 2024 22:49:39 GMT https://community.splunk.com/t5/Splunk-Search/How-to-include-the-country-in-the-PIE-chart/m-p/682918#M233258 ITWhisperer 2024-04-02T22:49:39Z https://community.splunk.com/t5/Splunk-Search/How-to-include-the-country-in-the-PIE-chart/m-p/682920#M233260 <P>You will either have to show the pie chart as a trellis chart so it shows one chart for each country or create a composite field containing both country and error message, as the pie chart can only show one dimension, i.e.</P><LI-CODE lang="markup">index=test | iplocation Properties.ip | dedup Properties.ip | eval composite=country.":".'event.Properties.errMessage' | stats count by composite</LI-CODE><P>&nbsp;Then the composite will be Australia:OK and so on.</P><P>&nbsp;</P> Tue, 02 Apr 2024 22:54:28 GMT https://community.splunk.com/t5/Splunk-Search/How-to-include-the-country-in-the-PIE-chart/m-p/682920#M233260 bowesmana 2024-04-02T22:54:28Z https://community.splunk.com/t5/Splunk-Search/How-to-include-the-country-in-the-PIE-chart/m-p/682940#M233270 <P><SPAN>Create a composite field with the two labels concatenated and count by that</SPAN></P><P><SPAN>I am not sure how to create composite filed, could you please advice on this please</SPAN></P><P>&nbsp;</P> Wed, 03 Apr 2024 03:06:45 GMT https://community.splunk.com/t5/Splunk-Search/How-to-include-the-country-in-the-PIE-chart/m-p/682940#M233270 jaibalaraman 2024-04-03T03:06:45Z