Dashboards & Visualizations

Displaying string value in pie chart

gmishra
New Member

I use multiple saves searches from different chart to display overall application health status. The chart works fine for me accept it only shows colors. I am working to display the string value (green, yellow, red) on the pie chart but it doesnt work as expected.

Splunk pie chart (somehow) never displays the color name on the chart. I was wondering if there is a way to display the value on the chart. I tried to use the single value chart but looks like it adds colors only for numerical values and not for string.

Please help me understand if anyone of you have achieved this in Splunk. Here are some additional details.

<panel>
  <chart>
    <title>Agent Portal</title>
    <search>
      <query>
        | savedsearch "A" 
        | append [ | savedsearch "B"] 
        | append [ | savedsearch "C"]
        | append [ | savedsearch "D"]
        | append [ | savedsearch "E"]
        | append [ | savedsearch "F"]
        | append [ | savedsearch "G"] 
        | eval overall_health = min(availability_severity, performance_severity, apdex_severity, report_GCPA_severity, report_NBP_severity, report_OReq_severity, report_PGA_severity) 
        | stats min(overall_health) as severity 
        | eval color=case(severity="1","red",severity="2","yellow",severity="3","green") 
        | chart count by color
      </query>
      <earliest>-15m</earliest>
      <latest>now</latest>
      <refresh>60s</refresh>
      <refreshType>delay</refreshType>
    </search>
    <option name="charting.chart">pie</option>
    <option name="charting.chart.showLabels">0</option>
    <option name="height">100</option>
    <option name="charting.fieldColors">{"red":0xff0000,"yellow":0xffc300,"green":0x65a637}</option>
    <drilldown>
      <link target="_blank">/app/search/application_health__agent_portal</link>
    </drilldown>
  </chart>
</panel>
Tags (2)
0 Karma

koshyk
Super Champion

Similar question already answered in here: https://answers.splunk.com/answers/71090/how-to-display-the-count-in-piechart-as-labels.html

Basically, Simple two options
1. show as percent

 <option name="charting.chart.showPercent">true</option>

2.Trick to include the value as a string

.. | stats count by severity | eval severity_slice = count + " " + severity | fields severity_slice, count
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Matching cron expressions

This puzzle (first published here) is based on matching timestamps to cron expressions.All the timestamps ...

Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas

Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas     Cisco Live 2026 is almost here, and this ...

Data Management Digest – May 2026

Welcome to the May 2026 edition of Data Management Digest!   As your trusted partner in data innovation, the ...