https://community.splunk.com/t5/Splunk-Search/display-sum-value-in-pie-chart/m-p/168157#M47931 <P>Here's an example based on <CODE>_internal</CODE> data:</P> <PRE><CODE>index=_internal bytes=* | stats sum(bytes) as sum by sourcetype | eval sourcetype = sourcetype . " (sum=" . sum . ")" </CODE></PRE> <P>By changing the <CODE>sourcetype</CODE> field I'm basically changing the pie chart labels.</P> Sat, 20 Jun 2015 11:34:51 GMT martin_mueller 2015-06-20T11:34:51Z https://community.splunk.com/t5/Splunk-Search/display-sum-value-in-pie-chart/m-p/168154#M47928 <P>I have used in the past count value in the pie chart. Now I need to display sum value in the chart. How can I do this?</P> <P>| stats sum(TotalCost) by ProductCode</P> <P>My intention is to display the sum(TotalCost) of each productType in the pie chart.</P> Sat, 20 Jun 2015 05:58:20 GMT https://community.splunk.com/t5/Splunk-Search/display-sum-value-in-pie-chart/m-p/168154#M47928 ashabc 2015-06-20T05:58:20Z https://community.splunk.com/t5/Splunk-Search/display-sum-value-in-pie-chart/m-p/168155#M47929 <P>Like this:</P> <PRE><CODE>... | chart sum(TotalCost) by ProductCode </CODE></PRE> Sat, 20 Jun 2015 06:05:26 GMT https://community.splunk.com/t5/Splunk-Search/display-sum-value-in-pie-chart/m-p/168155#M47929 woodcock 2015-06-20T06:05:26Z https://community.splunk.com/t5/Splunk-Search/display-sum-value-in-pie-chart/m-p/168156#M47930 <P>Thanks for a pormpt response, Woodcok. Not sure my question is clear. I want to display the actual value i.e. the sum of TotalCost for each product type in the pie chart. ... | chart sum(TotalCost) by ProductCode will only display the pie chart and not the actual values.</P> Sat, 20 Jun 2015 06:23:37 GMT https://community.splunk.com/t5/Splunk-Search/display-sum-value-in-pie-chart/m-p/168156#M47930 ashabc 2015-06-20T06:23:37Z https://community.splunk.com/t5/Splunk-Search/display-sum-value-in-pie-chart/m-p/168157#M47931 <P>Here's an example based on <CODE>_internal</CODE> data:</P> <PRE><CODE>index=_internal bytes=* | stats sum(bytes) as sum by sourcetype | eval sourcetype = sourcetype . " (sum=" . sum . ")" </CODE></PRE> <P>By changing the <CODE>sourcetype</CODE> field I'm basically changing the pie chart labels.</P> Sat, 20 Jun 2015 11:34:51 GMT https://community.splunk.com/t5/Splunk-Search/display-sum-value-in-pie-chart/m-p/168157#M47931 martin_mueller 2015-06-20T11:34:51Z https://community.splunk.com/t5/Splunk-Search/display-sum-value-in-pie-chart/m-p/168158#M47932 <P>Thank you. It worked.</P> Sun, 28 Jun 2015 00:28:58 GMT https://community.splunk.com/t5/Splunk-Search/display-sum-value-in-pie-chart/m-p/168158#M47932 ashabc 2015-06-28T00:28:58Z