Hi , I want to show the data in pie-chart based on the different search result.

[neha_h]

Hi All,
Currently I have below query which works fine for pie-chart for 3 different data , which is working fine.

"*test-path*" | bucket span=1d _time | rename test-path as path | eval result=case((path == "/test/orders"), "Order Data" , (path == "/test-data/orders"), "test order" , (path == "/test2-data2/orders/"), "Test data") | chart count by result | eval result = count + " " + result | fields result, count

but i want to extend it by adding 1 more search "test data for order - path" which is coming in the message key, I have tried below but not working:

"*test-path*" | bucket span=1d _time | rename test-path as path | **rename message as msg** | eval result=case((path == "/test/orders"), "Order Data" , (path == "/test-data/orders"), "test order" , (path == "/test2-data2/orders/"), "Test data" , (**msg == "*test data for order - path***"), "test data order") | chart count by result | eval result = count + " " + result | fields result, count

Can anyone plz help.

[richgalloway]

Please explain how the new query is not working. What results do you expect and what results do you get?

The case function returns the first matching expression. If an event contains both message="test data order"' and 'path=/test/orders' then result will be set to "Order Data".

[neha_h]

@richgalloway ,
this is my raw splunk events:-
message: Source :undefined, test Id :"76767676-ef2c-4bec-454-666111598873", msg : test data for order - path
extras-path: /test-data/orders
extras-path: /test/orders
so i can evaluate path with above query but not sure how to evaluate msg (since msg is inside message) and display it's count in the same pie-chart

[richgalloway]

Thank you for sharing the sample event. You still haven't described your expected and actual results.
Please run this query to verify the fields are as expected.

"*test-path*" | bucket span=1d _time | rename test-path as path | rename message as msg | table path msg