Creating Pie Chart with three separate fields and their percentage value

[P_raju]

Hi All,

I need to build pie chart for three separate fields which should display the field name and its percentage in the same pie chart. 

Eg: ial1, ial2 and ial3 are three different fields in Splunk. It should display in the attached format. Could someone help me on this.

P_raju_0-1635419411123.png

[ITWhisperer]

the standard pie chart doesn't display percentages except when you hover over the various segments. Is this sufficient? If so, you just need a table with id and count(?) and visualise that as a pie chart e.g.

| stats count by id

[jhanvidattani]

@P_raju 

You can use fieldsummary command to do this. Example: 

index="_internal"| fieldsummary | table field, distinct_count

 
If you find my solution/debugging steps fruitful, an upvote would be appreciated.

[P_raju]

Hi,

In Splunk, the fields are distinct as attached. Let me know how to combine these fields into single field so that i can create pie chart.

P_raju_0-1635879126851.png

Regards,

P_raju

[jhanvidattani]

You can try it as:

index<your_index> | fields ia_*| fieldsummary | table field, distinct_count

Pie chart will create sections depending on count of each field and calculate percentage by default (visible by hovering on each segment).  

[ITWhisperer]

I have assumed you want to count the ia* fields - if you want something else, change the stats function - the key is to then transpose to get each ia* value as a different event

| gentimes start=-1 increment=10m 
| eval id="ia".(random()%3)."_users"
| table id
| eval {id}=random()%10
| fields - id


| stats count(ia*_users) as ia*_users
| transpose 0