Charting question

[jaywv6299]

I have a log file that comes in and has something that looks like

cn=ABC TotalNo=36,availableNo=21,productionNo=15

another line

cn=DEF TotalNo=21,availableNo=15,productionNo=6

I would like to create a pie chart for all available cn= (could be 10 productnames could be 100) and have the pie chart be TotalNo and availableNo and productionNo be a portion of that PIE chart.

Also would like to make it so that if availableNo is less that 3 that there is an alert or change in chart colors to red.

[kristian_kolb]

Even though I haven't tried to dynamically create an arbitrary number of dashboard panels based on search results, I think it might be hard/impossible (I might be wrong though). It is probably simpler if you can live with a bar or column chart like so;

your search for events | chart first(availableNo) as Available first(productionNo) as Production by cn

Then you click the little chart icon called "Results Chart", and alter the formatting options by selecting bar or column chart, and set "Stack mode" to "Stacked" and "Multi-series mode" to "Combined". The layout can be a bit cluttered if you have more than 30 bars/columns.

For the alerting part, you should probably read the Alerting manual

For the chart changing colour.. dunno... maybe in the Visualizaion Manual

Hope this helps,

k