Dashboards & Visualizations

How do I make a piechart that shows an additional section for events that "miss" value for a given field?

twalander
Engager

I want to build a pie chart showing which values are present for a certain field (country below). But, I want the pie chart to also include a section showing how many of the events that completely lack this field.

The following search gives me all events I am interested in for the Pie Chart "total".

index=starbug service=my-service line.req.headers.referer=*\/endpoint*

Sometimes, the referrer field contains a query parameter, which is the field I'm interested in, for my pie chart sections, and I can extract the value like so:

index=starbug service=my-service line.req.headers.referer=*\/endpoint* | rex field=line.req.headers.referer "country=(?<country>.{2})"

However, when turning this into a chart...

index=starbug service=my-service line.req.headers.referer=\/endpoint | rex field=line.req.headers.referer "country=(?.{2})" | chart count by country
...the pie chart "ignores" the events that don't have a value for country.

but what I'm expecting is something like this:

SE           20%
NO         10% 
null         70% (this is the one that is missing)

I've tried things like usenull=t and useother=t , but it's not changing anything, so I think I'm misunderstanding something here.

0 Karma
1 Solution

renjith_nair
Legend

@twalander,

Try replacing the real null with a "NULL" string .

For e.g.

  index=starbug service=my-service line.req.headers.referer=*\/endpoint* | rex field=line.req.headers.referer "country=(?<country>.{2})" |fillnull value=NULL | chart count by country
Happy Splunking!

View solution in original post

renjith_nair
Legend

@twalander,

Try replacing the real null with a "NULL" string .

For e.g.

  index=starbug service=my-service line.req.headers.referer=*\/endpoint* | rex field=line.req.headers.referer "country=(?<country>.{2})" |fillnull value=NULL | chart count by country
Happy Splunking!

twalander
Engager

Thanks that's exactly what I needed! 🙂

0 Karma
Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...