Dashboards & Visualizations

Creating Pie Chart with three separate fields and their percentage value

P_raju
New Member

Hi All,

I need to build pie chart for three separate fields which should display the field name and its percentage in the same pie chart. 

Eg: ial1, ial2 and ial3 are three different fields in Splunk. It should display in the attached format. Could someone help me on this.

P_raju_0-1635419411123.png

 

Labels (2)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

the standard pie chart doesn't display percentages except when you hover over the various segments. Is this sufficient? If so, you just need a table with id and count(?) and visualise that as a pie chart e.g.

| stats count by id

 

0 Karma

jhanvidattani
Path Finder

@P_raju 

You can use fieldsummary command to do this. Example: 

index="_internal"| fieldsummary | table field, distinct_count

 
If you find my solution/debugging steps fruitful, an upvote would be appreciated.

0 Karma

P_raju
New Member

Hi,

In Splunk, the fields are distinct as attached. Let me know how to combine these fields into single field so that i can create pie chart.

P_raju_0-1635879126851.png

Regards,

P_raju

0 Karma

jhanvidattani
Path Finder

You can try it as:

index<your_index> | fields ia_*| fieldsummary | table field, distinct_count

Pie chart will create sections depending on count of each field and calculate percentage by default (visible by hovering on each segment).  

Tags (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

I have assumed you want to count the ia* fields - if you want something else, change the stats function - the key is to then transpose to get each ia* value as a different event

| gentimes start=-1 increment=10m 
| eval id="ia".(random()%3)."_users"
| table id
| eval {id}=random()%10
| fields - id


| stats count(ia*_users) as ia*_users
| transpose 0
0 Karma
Get Updates on the Splunk Community!

Index This | What did the zero say to the eight?

June 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...

Splunk Observability Cloud's AI Assistant in Action Series: Onboarding New Hires & ...

This is the fifth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Now Playing: Splunk Education Summer Learning Premieres

It’s premiere season, and Splunk Education is rolling out new releases you won’t want to miss. Whether you’re ...