Dashboards & Visualizations

How to create a pie chart of percentages out of just numeric token values?

smhsplunk
Communicator

Trying to do a pie chart out of just numeric values, getting values from different tokens and using them for this piechart, I just want to show them as % of the entire sum of numeric token values. How do you create a list of values for piechart?

index=main host="*"
| eval token1="$token1$"
| eval token2="$token2$"
| eval token3="$token3$"
| eval token4 = "$token4$"
| eval token_times = list(token1, token2, token3, token4)
| stats values by token_times
0 Karma
1 Solution

somesoni2
Revered Legend

I think something like this would work (first line is just to generate a single row where token fields can be created)

Updated

| gentimes start=-1 
| eval token1="$token1$"
 | eval token2="$token2$"
 | eval token3="$token3$"
 | eval token4 = "$token4$"
| table token*  | eval token=1 | untable token tokens value | table tokens value

View solution in original post

somesoni2
Revered Legend

I think something like this would work (first line is just to generate a single row where token fields can be created)

Updated

| gentimes start=-1 
| eval token1="$token1$"
 | eval token2="$token2$"
 | eval token3="$token3$"
 | eval token4 = "$token4$"
| table token*  | eval token=1 | untable token tokens value | table tokens value

smhsplunk
Communicator

This again gives me a table with all values, but when I try to convert it into a piechart using visualization it shows a single color for the entire piechart (currently it shows)

token0: 0
token1: 55%
token1%: 100%

I don't have pie slices per tokens

0 Karma

somesoni2
Revered Legend

Try updated answer.

0 Karma

smhsplunk
Communicator

This is great, this works, last question is it possible to change the token names after the last line, I tried to do but it retains the old token labels as token1, token2...

0 Karma

somesoni2
Revered Legend

What do you want it to be changed as? I guess you can just create the field with the name you want at the first place and you should be good (update token name in eval and table command)

0 Karma

smhsplunk
Communicator

yup thanks!

0 Karma

jkat54
SplunkTrust
SplunkTrust

Need a mvexpand in there to create 4 rows each with ts own token value before you take to pie chart...

  ... (Your 1st 4 evals) ...
  | eval a=mvzip(token1,token2) | eval b=mvzip(token3,token4) | eval allTokens=mvzip(a,b) | mvexpand allTokens | eval count=allTokens | stats count by allTokens
0 Karma

jkat54
SplunkTrust
SplunkTrust

You may be able to skip the first 4 evals if you use the tokens in the mvzips instead

0 Karma

smhsplunk
Communicator

Its giving me a piechart with a single color and single label "token1,token2,token2..."

0 Karma

jkat54
SplunkTrust
SplunkTrust

What search did you end up with?

0 Karma

jkat54
SplunkTrust
SplunkTrust

Wait, what value is supposed to fill the pieces of the pie and what label should label the pie pieces?

Your providing one value for each field via the token. I assume you want that as the value/count. So then token1, token2, token3, and token4 should be the labels?

0 Karma

jkat54
SplunkTrust
SplunkTrust

Maybe this:

  index=main host="*" | eval token1="$token1$"| eval token2="$token2$"| eval token3="$token3$"| eval token4 = "$token4$"| chart values(token*) by token*
0 Karma

smhsplunk
Communicator

Please see this simplified example (this doesnt work)

index=main host="*"
             | eval token1=10
              | eval token2=20
              | eval token3=30 | stats values(token*) by token*

so I would like the piechart to have labels 10 (20% slice), 20 (40% slice) and 30 (60% slice)
The correct slices are more important than labels i guess..

0 Karma
Get Updates on the Splunk Community!

Take Your Breath Away with Splunk Risk-Based Alerting (RBA)

WATCH NOW!The Splunk Guide to Risk-Based Alerting is here to empower your SOC like never before. Join Haylee ...

Industry Solutions for Supply Chain and OT, Amazon Use Cases, Plus More New Articles ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Enterprise Security Content Update (ESCU) | New Releases

In November, the Splunk Threat Research Team had one release of new security content via the Enterprise ...