My index is as below:
index | stats count by c4rupgrd-sourceVersion c4rupgrd-targetVersion
I want the percentage is calculated by count in pie chart.
@jerrytao
Your search producing 3 columns & in Pie Chart If the search generates a table with more than two columns, the extra columns are ignored.
. Check https://docs.splunk.com/Documentation/SplunkCloud/7.2.6/Viz/PieChart#Data_formatting
If you observed in your existing pie chart count
field is totally ignored which is important for you.
If it's important to display both 'c4rupgrd-sourceVersion&
c4rupgrd-targetVersion` values in Pie chart then I suggest combining the value of both the fields and use it. Please check below SPL for same
YOUR_SEARCH | eval c4rupgrd-sourceVersion_c4rupgrd-targetVersion = tostring('c4rupgrd-sourceVersion')."-".tostring('c4rupgrd-targetVersion') | table c4rupgrd-sourceVersion_c4rupgrd-targetVersion count
My Sample search:
| makeresults | eval c4rupgrd-sourceVersion=2018,c4rupgrd-targetVersion=2019,count=11 | append [ | makeresults | eval c4rupgrd-sourceVersion=2018,c4rupgrd-targetVersion=2020,count=1] | append [ | makeresults | eval c4rupgrd-sourceVersion=2010,c4rupgrd-targetVersion=2020,count=3] | eval c4rupgrd-sourceVersion_c4rupgrd-targetVersion = tostring('c4rupgrd-sourceVersion')."-".tostring('c4rupgrd-targetVersion') | table c4rupgrd-sourceVersion_c4rupgrd-targetVersion count
Thanks
@jerrytao
Your search producing 3 columns & in Pie Chart If the search generates a table with more than two columns, the extra columns are ignored.
. Check https://docs.splunk.com/Documentation/SplunkCloud/7.2.6/Viz/PieChart#Data_formatting
If you observed in your existing pie chart count
field is totally ignored which is important for you.
If it's important to display both 'c4rupgrd-sourceVersion&
c4rupgrd-targetVersion` values in Pie chart then I suggest combining the value of both the fields and use it. Please check below SPL for same
YOUR_SEARCH | eval c4rupgrd-sourceVersion_c4rupgrd-targetVersion = tostring('c4rupgrd-sourceVersion')."-".tostring('c4rupgrd-targetVersion') | table c4rupgrd-sourceVersion_c4rupgrd-targetVersion count
My Sample search:
| makeresults | eval c4rupgrd-sourceVersion=2018,c4rupgrd-targetVersion=2019,count=11 | append [ | makeresults | eval c4rupgrd-sourceVersion=2018,c4rupgrd-targetVersion=2020,count=1] | append [ | makeresults | eval c4rupgrd-sourceVersion=2010,c4rupgrd-targetVersion=2020,count=3] | eval c4rupgrd-sourceVersion_c4rupgrd-targetVersion = tostring('c4rupgrd-sourceVersion')."-".tostring('c4rupgrd-targetVersion') | table c4rupgrd-sourceVersion_c4rupgrd-targetVersion count
Thanks
@kamlesh_vaghela , it works as expected. I really appreciate your help!
Glad to help you @jerrytao
Happy Splunking