All Apps and Add-ons

Donut Chart

TDR57
Explorer

Hi

I am trying to convert a PIE Chart which works and displays correctly over to using a Donut Chart but it doesnt display any values. 

Has anyone come across this issue and what was the fix

Thanks 

Terry

 

Labels (2)
0 Karma

TDR57
Explorer

index= itam-reporting-database-app-n source=kafka:raw-str-itamr-change-audit*

| eval product_name = PRODUCT_NAME__2_
| search (product_name=SOM-B2B)
| dedup "INFRASTRUCTURE_CHANGE_ID"

| stats dc(INFRASTRUCTURE_CHANGE_ID) as ALL_count by RISK_LEVEL
| eval outcome = (RISK_LEVEL." - ")
| eval outcome = (outcome.ALL_count)
| table outcome ALL_count RISK_LEVEL

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@TDR57 

You should table only  outcome and ALL_count.. like 

| table outcome ALL_count

 

BTW which visualisation app you are using for Donut chart?

 

0 Karma

TDR57
Explorer

Hi i did try that as well. the donut chart is  Donut - Custom Visualization

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@TDR57 

It's working for me. Is this same you are looking for?

 

 

Screenshot 2021-07-02 at 11.32.19 AM.png

This is my search query for replicate same.

index="_internal" sourcetype="splunkd*" | stats count as ALL_count by sourcetype | rename sourcetype as RISK_LEVEL
| eval outcome = (RISK_LEVEL." - ")
| eval outcome = (outcome.ALL_count)
| table outcome ALL_count

 You can try this at your local machine as well.

Thanks
KV
▄︻̷̿┻̿═━一

If any of my reply helps you to solve the problem Or gain knowledge, an upvote would be appreciated. 

TDR57
Explorer

This did help but unfortunately it does show the Legend either

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

What is your expectations about the Legend?

 

0 Karma

TDR57
Explorer

This is what i meant 

 

TDR57_0-1625485547867.png

and this is what i get

TDR57_1-1625485635986.png

 

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@TDR57 

Can you please try this?

<dashboard theme="dark">
  <label>Donut chart</label>
  <row>
    <panel depends="$hideMe$">
      <html>
        <style>
          #donut_chart_1 text.c3-chart-arcs-title {
              fill: white;
          }
          #donut_chart_1 .c3-tooltip-container {
            color: black;
          }
        </style>
      </html>
    </panel>
    <panel id="donut_chart_1">
      <viz type="viz_donut_c3.c3donut">
        <search>
          <query>index="_internal" sourcetype="splunkd*" | stats count as ALL_count by sourcetype | rename sourcetype as RISK_LEVEL
| eval outcome = (RISK_LEVEL." - ")
| eval outcome = (outcome.ALL_count)
| table outcome ALL_count</query>
          <earliest>-60m@m</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="drilldown">none</option>
        <option name="trellis.enabled">0</option>
        <option name="trellis.scales.shared">1</option>
        <option name="trellis.size">medium</option>
      </viz>
    </panel>
  </row>
</dashboard>

 

 

Screenshot 2021-07-05 at 7.36.20 PM.png

Thanks
KV
▄︻̷̿┻̿═━一

If any of my reply helps you to solve the problem Or gain knowledge, an upvote would be appreciated.

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@TDR57 

Can you pleas share you sample code?

 

0 Karma
Get Updates on the Splunk Community!

Introducing Ingest Actions: Filter, Mask, Route, Repeat

WATCH NOW Ingest Actions (IA) is the best new way to easily filter, mask and route your data in Splunk® ...

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...