All Apps and Add-ons

Donut Chart

TDR57
Explorer

Hi

I am trying to convert a PIE Chart which works and displays correctly over to using a Donut Chart but it doesnt display any values. 

Has anyone come across this issue and what was the fix

Thanks 

Terry

 

Labels (2)
0 Karma

TDR57
Explorer

index= itam-reporting-database-app-n source=kafka:raw-str-itamr-change-audit*

| eval product_name = PRODUCT_NAME__2_
| search (product_name=SOM-B2B)
| dedup "INFRASTRUCTURE_CHANGE_ID"

| stats dc(INFRASTRUCTURE_CHANGE_ID) as ALL_count by RISK_LEVEL
| eval outcome = (RISK_LEVEL." - ")
| eval outcome = (outcome.ALL_count)
| table outcome ALL_count RISK_LEVEL

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@TDR57 

You should table only  outcome and ALL_count.. like 

| table outcome ALL_count

 

BTW which visualisation app you are using for Donut chart?

 

0 Karma

TDR57
Explorer

Hi i did try that as well. the donut chart is  Donut - Custom Visualization

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@TDR57 

It's working for me. Is this same you are looking for?

 

 

Screenshot 2021-07-02 at 11.32.19 AM.png

This is my search query for replicate same.

index="_internal" sourcetype="splunkd*" | stats count as ALL_count by sourcetype | rename sourcetype as RISK_LEVEL
| eval outcome = (RISK_LEVEL." - ")
| eval outcome = (outcome.ALL_count)
| table outcome ALL_count

 You can try this at your local machine as well.

Thanks
KV
▄︻̷̿┻̿═━一

If any of my reply helps you to solve the problem Or gain knowledge, an upvote would be appreciated. 

TDR57
Explorer

This did help but unfortunately it does show the Legend either

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

What is your expectations about the Legend?

 

0 Karma

TDR57
Explorer

This is what i meant 

 

TDR57_0-1625485547867.png

and this is what i get

TDR57_1-1625485635986.png

 

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@TDR57 

Can you please try this?

<dashboard theme="dark">
  <label>Donut chart</label>
  <row>
    <panel depends="$hideMe$">
      <html>
        <style>
          #donut_chart_1 text.c3-chart-arcs-title {
              fill: white;
          }
          #donut_chart_1 .c3-tooltip-container {
            color: black;
          }
        </style>
      </html>
    </panel>
    <panel id="donut_chart_1">
      <viz type="viz_donut_c3.c3donut">
        <search>
          <query>index="_internal" sourcetype="splunkd*" | stats count as ALL_count by sourcetype | rename sourcetype as RISK_LEVEL
| eval outcome = (RISK_LEVEL." - ")
| eval outcome = (outcome.ALL_count)
| table outcome ALL_count</query>
          <earliest>-60m@m</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="drilldown">none</option>
        <option name="trellis.enabled">0</option>
        <option name="trellis.scales.shared">1</option>
        <option name="trellis.size">medium</option>
      </viz>
    </panel>
  </row>
</dashboard>

 

 

Screenshot 2021-07-05 at 7.36.20 PM.png

Thanks
KV
▄︻̷̿┻̿═━一

If any of my reply helps you to solve the problem Or gain knowledge, an upvote would be appreciated.

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@TDR57 

Can you pleas share you sample code?

 

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...