Archive

plotting using data across multiple indexes

Path Finder

index=index1 | stats sum(feild1) as totalAmount1
index=index 2| stats sum(feild2) as totalAmount2
index=index 3| stats sum(feild3) as totalAmount3

I need to display data from above 3 searches in the form of pie chart. Each pie section corresponds to each of the totals

piechart=piesection1 should correspond to totalAmount1 +
piesection2 should correspond to totalAmount2 +
piesection3 should correspond to totalAmount3

Can you please guide me as to how this can be performed.

Please note the filed1,field2 & field3 are not common across indexes each of those represent order amount for that index.

Can you guide me as to how this can be achieved

thanks!

1 Solution

Splunk Employee
Splunk Employee

Try something like this:

index=index1 OR index=index2 OR index=index3
| fields field1, field2, field3, index
| eval grouped_fields = coalesce(field1, field2, field3)
| chart sum(grouped_fields) by index

Then just go to the visualization drop down and select the pie.


So what's actually happening ? Rather than thinking about this as three seperate searches, we go ahead and specify all the indexes we might search for and all the fields we are interested in the first two lines:

index=index1 OR index=index2 OR index=index3
| fields field1, field2, field3, index

Next, we use eval to push all those fields into one field. Now this seems counterintuitive but the reason that it works is because we can still use their values for the index field to keep them distinct. Grouping them together just allows us to push them all into the same sum() function. coalesce() here is taking any number of arguments and returning the whichever is not null.

| eval grouped_fields = coalesce(field1, field2, field3)

Lastly, you can use chart (or stats if you want) to get the sum, splitting by index. One last thing you could do, would be rename the indexes to what ever they might be representing.

View solution in original post

Splunk Employee
Splunk Employee

Try something like this:

index=index1 OR index=index2 OR index=index3
| fields field1, field2, field3, index
| eval grouped_fields = coalesce(field1, field2, field3)
| chart sum(grouped_fields) by index

Then just go to the visualization drop down and select the pie.


So what's actually happening ? Rather than thinking about this as three seperate searches, we go ahead and specify all the indexes we might search for and all the fields we are interested in the first two lines:

index=index1 OR index=index2 OR index=index3
| fields field1, field2, field3, index

Next, we use eval to push all those fields into one field. Now this seems counterintuitive but the reason that it works is because we can still use their values for the index field to keep them distinct. Grouping them together just allows us to push them all into the same sum() function. coalesce() here is taking any number of arguments and returning the whichever is not null.

| eval grouped_fields = coalesce(field1, field2, field3)

Lastly, you can use chart (or stats if you want) to get the sum, splitting by index. One last thing you could do, would be rename the indexes to what ever they might be representing.

View solution in original post

Path Finder

@ aljohnson_splunk---Thanks alot for the quick response and it worked like a charm, i have been trying it out all day and your direction solved it in a minute...thank you again!!

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!