It's working for me. Is this same you are looking for?
This is my search query for replicate same.
index="_internal" sourcetype="splunkd*" | stats count as ALL_count by sourcetype | rename sourcetype as RISK_LEVEL
| eval outcome = (RISK_LEVEL." - ")
| eval outcome = (outcome.ALL_count)
| table outcome ALL_countYou can try this at your local machine as well.
Thanks
KV
▄︻̷̿┻̿═━一
If any of my reply helps you to solve the problem Or gain knowledge, an upvote would be appreciated.
This is what i meant
and this is what i get
Can you please try this?
<dashboard theme="dark">
<label>Donut chart</label>
<row>
<panel depends="$hideMe$">
<html>
<style>
#donut_chart_1 text.c3-chart-arcs-title {
fill: white;
}
#donut_chart_1 .c3-tooltip-container {
color: black;
}
</style>
</html>
</panel>
<panel id="donut_chart_1">
<viz type="viz_donut_c3.c3donut">
<search>
<query>index="_internal" sourcetype="splunkd*" | stats count as ALL_count by sourcetype | rename sourcetype as RISK_LEVEL
| eval outcome = (RISK_LEVEL." - ")
| eval outcome = (outcome.ALL_count)
| table outcome ALL_count</query>
<earliest>-60m@m</earliest>
<latest>now</latest>
<sampleRatio>1</sampleRatio>
</search>
<option name="drilldown">none</option>
<option name="trellis.enabled">0</option>
<option name="trellis.scales.shared">1</option>
<option name="trellis.size">medium</option>
</viz>
</panel>
</row>
</dashboard>
Thanks
KV
▄︻̷̿┻̿═━一
If any of my reply helps you to solve the problem Or gain knowledge, an upvote would be appreciated.
