https://community.splunk.com/t5/Splunk-Search/chart-after-using-stats-latest/m-p/330507#M98383 <P>I have the following command:</P> <P>sourcetype="sourcetype" eventid=731 OR eventid=730<BR /> | stats latest(eventid) by target<BR /> | chart count by eventid</P> <P>the 2nd line works as expected, but when I add in the 3rd line, i get "No results found"</P> <P>I want to display the results of the 2nd line in a pie chart rather than a table.</P> Mon, 23 Oct 2017 15:38:15 GMT jared_anderson 2017-10-23T15:38:15Z https://community.splunk.com/t5/Splunk-Search/chart-after-using-stats-latest/m-p/330507#M98383 <P>I have the following command:</P> <P>sourcetype="sourcetype" eventid=731 OR eventid=730<BR /> | stats latest(eventid) by target<BR /> | chart count by eventid</P> <P>the 2nd line works as expected, but when I add in the 3rd line, i get "No results found"</P> <P>I want to display the results of the 2nd line in a pie chart rather than a table.</P> Mon, 23 Oct 2017 15:38:15 GMT https://community.splunk.com/t5/Splunk-Search/chart-after-using-stats-latest/m-p/330507#M98383 jared_anderson 2017-10-23T15:38:15Z https://community.splunk.com/t5/Splunk-Search/chart-after-using-stats-latest/m-p/330508#M98384 <P>Hi<BR /> add <CODE>AS eventid</CODE> to your stats command</P> <PRE><CODE>sourcetype="sourcetype" eventid=731 OR eventid=730 | stats latest(eventid) AS eventId by target | chart count by eventid </CODE></PRE> <P>Bye.<BR /> Giuseppe</P> Mon, 23 Oct 2017 15:43:37 GMT https://community.splunk.com/t5/Splunk-Search/chart-after-using-stats-latest/m-p/330508#M98384 gcusello 2017-10-23T15:43:37Z https://community.splunk.com/t5/Splunk-Search/chart-after-using-stats-latest/m-p/330509#M98385 <P>why is the AS eventid needed?</P> Mon, 23 Oct 2017 15:45:38 GMT https://community.splunk.com/t5/Splunk-Search/chart-after-using-stats-latest/m-p/330509#M98385 jared_anderson 2017-10-23T15:45:38Z https://community.splunk.com/t5/Splunk-Search/chart-after-using-stats-latest/m-p/330510#M98386 <P>Because if you don't use it, the stats result field name is latest(eventId) as you can see in the column header running Your first two tows.<BR /> Bye.<BR /> Giuseppe </P> Mon, 23 Oct 2017 16:00:21 GMT https://community.splunk.com/t5/Splunk-Search/chart-after-using-stats-latest/m-p/330510#M98386 gcusello 2017-10-23T16:00:21Z https://community.splunk.com/t5/Splunk-Search/chart-after-using-stats-latest/m-p/330511#M98387 <P>@jared_anderson, following should also give you same result. Dedup will get latest events for each target which enables you to count latest eventid for unique targets.</P> <PRE><CODE>sourcetype="sourcetype" eventid=731 OR eventid=730 | dedup target | chart count by eventid </CODE></PRE> Mon, 23 Oct 2017 16:31:23 GMT https://community.splunk.com/t5/Splunk-Search/chart-after-using-stats-latest/m-p/330511#M98387 niketn 2017-10-23T16:31:23Z