Dashboards & Visualizations

How to create a pie chart of percentages out of just numeric token values?

Communicator

Trying to do a pie chart out of just numeric values, getting values from different tokens and using them for this piechart, I just want to show them as % of the entire sum of numeric token values. How do you create a list of values for piechart?

index=main host="*"
| eval token1="$token1$"
| eval token2="$token2$"
| eval token3="$token3$"
| eval token4 = "$token4$"
| eval token_times = list(token1, token2, token3, token4)
| stats values by token_times
0 Karma
1 Solution

SplunkTrust
SplunkTrust

I think something like this would work (first line is just to generate a single row where token fields can be created)

Updated

| gentimes start=-1 
| eval token1="$token1$"
 | eval token2="$token2$"
 | eval token3="$token3$"
 | eval token4 = "$token4$"
| table token*  | eval token=1 | untable token tokens value | table tokens value

View solution in original post

SplunkTrust
SplunkTrust

I think something like this would work (first line is just to generate a single row where token fields can be created)

Updated

| gentimes start=-1 
| eval token1="$token1$"
 | eval token2="$token2$"
 | eval token3="$token3$"
 | eval token4 = "$token4$"
| table token*  | eval token=1 | untable token tokens value | table tokens value

View solution in original post

Communicator

This again gives me a table with all values, but when I try to convert it into a piechart using visualization it shows a single color for the entire piechart (currently it shows)

token0: 0
token1: 55%
token1%: 100%

I don't have pie slices per tokens

0 Karma

SplunkTrust
SplunkTrust

Try updated answer.

0 Karma

Communicator

This is great, this works, last question is it possible to change the token names after the last line, I tried to do but it retains the old token labels as token1, token2...

0 Karma

SplunkTrust
SplunkTrust

What do you want it to be changed as? I guess you can just create the field with the name you want at the first place and you should be good (update token name in eval and table command)

0 Karma

Communicator

yup thanks!

0 Karma

SplunkTrust
SplunkTrust

Need a mvexpand in there to create 4 rows each with ts own token value before you take to pie chart...

  ... (Your 1st 4 evals) ...
  | eval a=mvzip(token1,token2) | eval b=mvzip(token3,token4) | eval allTokens=mvzip(a,b) | mvexpand allTokens | eval count=allTokens | stats count by allTokens
0 Karma

SplunkTrust
SplunkTrust

You may be able to skip the first 4 evals if you use the tokens in the mvzips instead

0 Karma

Communicator

Its giving me a piechart with a single color and single label "token1,token2,token2..."

0 Karma

SplunkTrust
SplunkTrust

What search did you end up with?

0 Karma

SplunkTrust
SplunkTrust

Wait, what value is supposed to fill the pieces of the pie and what label should label the pie pieces?

Your providing one value for each field via the token. I assume you want that as the value/count. So then token1, token2, token3, and token4 should be the labels?

0 Karma

SplunkTrust
SplunkTrust

Maybe this:

  index=main host="*" | eval token1="$token1$"| eval token2="$token2$"| eval token3="$token3$"| eval token4 = "$token4$"| chart values(token*) by token*
0 Karma

Communicator

Please see this simplified example (this doesnt work)

index=main host="*"
             | eval token1=10
              | eval token2=20
              | eval token3=30 | stats values(token*) by token*

so I would like the piechart to have labels 10 (20% slice), 20 (40% slice) and 30 (60% slice)
The correct slices are more important than labels i guess..

0 Karma