Dashboards & Visualizations
Highlighted

How to create a pie chart of percentages out of just numeric token values?

Communicator

Trying to do a pie chart out of just numeric values, getting values from different tokens and using them for this piechart, I just want to show them as % of the entire sum of numeric token values. How do you create a list of values for piechart?

index=main host="*"
| eval token1="$token1$"
| eval token2="$token2$"
| eval token3="$token3$"
| eval token4 = "$token4$"
| eval token_times = list(token1, token2, token3, token4)
| stats values by token_times
0 Karma
Highlighted

Re: How to create a pie chart of percentages out of just numeric token values?

SplunkTrust
SplunkTrust

Need a mvexpand in there to create 4 rows each with ts own token value before you take to pie chart...

  ... (Your 1st 4 evals) ...
  | eval a=mvzip(token1,token2) | eval b=mvzip(token3,token4) | eval allTokens=mvzip(a,b) | mvexpand allTokens | eval count=allTokens | stats count by allTokens
0 Karma
Highlighted

Re: How to create a pie chart of percentages out of just numeric token values?

SplunkTrust
SplunkTrust

You may be able to skip the first 4 evals if you use the tokens in the mvzips instead

0 Karma
Highlighted

Re: How to create a pie chart of percentages out of just numeric token values?

Communicator

Its giving me a piechart with a single color and single label "token1,token2,token2..."

0 Karma
Highlighted

Re: How to create a pie chart of percentages out of just numeric token values?

SplunkTrust
SplunkTrust

What search did you end up with?

0 Karma
Highlighted

Re: How to create a pie chart of percentages out of just numeric token values?

SplunkTrust
SplunkTrust

Wait, what value is supposed to fill the pieces of the pie and what label should label the pie pieces?

Your providing one value for each field via the token. I assume you want that as the value/count. So then token1, token2, token3, and token4 should be the labels?

0 Karma
Highlighted

Re: How to create a pie chart of percentages out of just numeric token values?

SplunkTrust
SplunkTrust

Maybe this:

  index=main host="*" | eval token1="$token1$"| eval token2="$token2$"| eval token3="$token3$"| eval token4 = "$token4$"| chart values(token*) by token*
0 Karma
Highlighted

Re: How to create a pie chart of percentages out of just numeric token values?

Communicator

Please see this simplified example (this doesnt work)

index=main host="*"
             | eval token1=10
              | eval token2=20
              | eval token3=30 | stats values(token*) by token*

so I would like the piechart to have labels 10 (20% slice), 20 (40% slice) and 30 (60% slice)
The correct slices are more important than labels i guess..

0 Karma
Highlighted

Re: How to create a pie chart of percentages out of just numeric token values?

SplunkTrust
SplunkTrust

I think something like this would work (first line is just to generate a single row where token fields can be created)

Updated

| gentimes start=-1 
| eval token1="$token1$"
 | eval token2="$token2$"
 | eval token3="$token3$"
 | eval token4 = "$token4$"
| table token*  | eval token=1 | untable token tokens value | table tokens value

View solution in original post

Highlighted

Re: How to create a pie chart of percentages out of just numeric token values?

Communicator

This again gives me a table with all values, but when I try to convert it into a piechart using visualization it shows a single color for the entire piechart (currently it shows)

token0: 0
token1: 55%
token1%: 100%

I don't have pie slices per tokens

0 Karma