https://community.splunk.com/t5/Splunk-Search/Intersect-Diff-and-Pie-Chart/m-p/199284#M57695 <P>Try this </P> <PRE><CODE>|inputlookup AD1.csv | fields hostname | join type=left hostname [|inputlookup DC1.csv | fields hostname | eval hasDC="Y"] | eval hasDC=coalesce(hasDC,"N") | chart count(eval(hasDC="Y")) as HasDC, count(eval(hasDC="N")) as NoDC </CODE></PRE> Thu, 09 Jan 2014 21:41:27 GMT somesoni2 2014-01-09T21:41:27Z https://community.splunk.com/t5/Splunk-Search/Intersect-Diff-and-Pie-Chart/m-p/199283#M57694 <P>I have a very large number of win7 machines. I pulled a CSV file from Active Directory, AD1.csv. I then created another CSV file from the deployment clients DC1.csv. What I want to do is compare the total number of clients with the number reporting in with deployment clients. I want a Pie Chart that is the total number of Win7 machines split between a slice that is the machines with deployment clients and a slice that are the machines without a deployment client.</P> <P>I was experimenting with | set diff [inputlookup AD1.csv | fields hostname][inputlookup DC1.csv | fields hostname] Where I am stumped is how to make that into a pie chart. Any ideas? Thanks!</P> Thu, 09 Jan 2014 21:31:20 GMT https://community.splunk.com/t5/Splunk-Search/Intersect-Diff-and-Pie-Chart/m-p/199283#M57694 belka 2014-01-09T21:31:20Z https://community.splunk.com/t5/Splunk-Search/Intersect-Diff-and-Pie-Chart/m-p/199284#M57695 <P>Try this </P> <PRE><CODE>|inputlookup AD1.csv | fields hostname | join type=left hostname [|inputlookup DC1.csv | fields hostname | eval hasDC="Y"] | eval hasDC=coalesce(hasDC,"N") | chart count(eval(hasDC="Y")) as HasDC, count(eval(hasDC="N")) as NoDC </CODE></PRE> Thu, 09 Jan 2014 21:41:27 GMT https://community.splunk.com/t5/Splunk-Search/Intersect-Diff-and-Pie-Chart/m-p/199284#M57695 somesoni2 2014-01-09T21:41:27Z