Dashboards & Visualizations
Highlighted

Could you help me link a pie chart with an input token?

Contributor

hello

I use the code below for doing a pie chart

index=windows sourcetype="wineventlog:system" SourceName="Disk" EventCode=7 Type="Critique" 
| dedup _time 
| stats count by EventCode
| eventstats sum(count) as Total 
| eval percent=round((count/Total)*100,1) 
| eval EventCode=EventCode."(count: ".count.", percent: ".percent.")"

I need to update automatically this pie chart from an input token which represents the hostname.

I have something like this, but it doesn't work.

| stats count by EventCode, host

have you an idea please???

0 Karma
Highlighted

Re: Could you help me link a pie chart with an input token?

Contributor

Nobody can't help me please??

0 Karma
Highlighted

Re: Could you help me link a pie chart with an input token?

SplunkTrust
SplunkTrust

@jip31,

if you just want to filter based on the host name from the token, then try adding this to your base search.

     index=windows sourcetype="wineventlog:system" SourceName="Disk" EventCode=7 Type="Critique"  host=$hostname$
0 Karma
Highlighted

Re: Could you help me link a pie chart with an input token?

Contributor

hi it's what i m doing but when i m doing this in my report I cant have any results....

0 Karma
Highlighted

Re: Could you help me link a pie chart with an input token?

SplunkTrust
SplunkTrust

Try one of the hostnames which is a candidate for $hostname$ and search in search window and see if it returns

0 Karma
Highlighted

Re: Could you help me link a pie chart with an input token?

Contributor

pearhaps I have bad explained
my token works with * or with an exact host
but i would like to have no pie chart if a wrong host is entered in the token
even with a wrong host actually my pie chart is always displayed....

0 Karma