Dashboards & Visualizations

How to create a piechart with two value fields?

New Member

I wanted to create a piechart with the X and Y,I have already counted coming in from the data
example of event data:
1/30/18 7:15:22.000 PM 2018-01-30 11:05:12.26;DEV;compute;X;Y

X is the good_count
Y is the bad_count
0 Karma
1 Solution

SplunkTrust
SplunkTrust

Provided you already have the goodcount and badcount fields extracted for environment="DEV" ( or process="compute"), you can try the following:

<YourBaseSearch>
| table environment bad_count good_count
| transpose header_field="environment" column_name="environment"

Following is a run anywhere search based on data/details provided:

| makeresults
| eval _raw="1/30/18 7:15:22.000 PM 2018-01-30 11:05:12.26;DEV;compute;40;5"
| rex "(AM|PM)\s(?<_time>[^;]+);(?<environment>[^;]+);(?<process>[^;]+);(?<good_count>[^;]+);(?<bad_count>\d+)"
| table environment bad_count good_count
| transpose header_field="environment" column_name="environment"
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

Champion

You could use transpose for this. For a run-anywhere example, try:

| makeresults 
| eval _raw="1/30/18 7:15:22.000 PM 2018-01-30 11:05:12.26;DEV;compute;150;35"
| rex "compute;(?<good_count>[^;]+);(?<bad_count>.*)"
| table good_count bad_count
| transpose

Then look at the visualization tab and change to pie chart.

SplunkTrust
SplunkTrust

Provided you already have the goodcount and badcount fields extracted for environment="DEV" ( or process="compute"), you can try the following:

<YourBaseSearch>
| table environment bad_count good_count
| transpose header_field="environment" column_name="environment"

Following is a run anywhere search based on data/details provided:

| makeresults
| eval _raw="1/30/18 7:15:22.000 PM 2018-01-30 11:05:12.26;DEV;compute;40;5"
| rex "(AM|PM)\s(?<_time>[^;]+);(?<environment>[^;]+);(?<process>[^;]+);(?<good_count>[^;]+);(?<bad_count>\d+)"
| table environment bad_count good_count
| transpose header_field="environment" column_name="environment"
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

New Member

How do I display those values goodcount,badcount on pie slices ?

0 Karma

SplunkTrust
SplunkTrust

Add the following as final pipe | eval environment=environment." (".DEV.")"

Following is the updated run anywhere search

 | makeresults
 | eval _raw="1/30/18 7:15:22.000 PM 2018-01-30 11:05:12.26;DEV;compute;40;5"
 | rex "(AM|PM)\s(?<_time>[^;]+);(?<environment>[^;]+);(?<process>[^;]+);(?<good_count>[^;]+);(?<bad_count>\d+)"
 | table environment bad_count good_count
 | transpose header_field="environment" column_name="environment"
 | eval environment=environment." (".DEV.")"
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma