How to customize pie chart total value with nested data?

[V21MGharib]

Hello,

I'm a newbie in splunk and I'd like to draw a pie chart where the total value is taken from a csv sheet.

e.g. X = 2 & Y = 10 and I'd like the pie chart total to take the value of (Y) and (X) to be part of it with its percentage. So, total pie chart value is 100% where the 100% represents the $value of Y and X represents 20% of it.

The best query I reached is (index="A" source="*B*"  | chart values(X) over Y | transpose) however the chart represents the percentage of X & Y as if the total value of the pie chart is (X+Y) which is not the case I want.

[kamlesh_vaghela · Accepted solution]

@V21MGharib 

Here you can do some tricks to get the value of the remaining field (assume Z) and work with this Z field to represent data.

Like, this

| makeresults
| eval X=2,Y=10 
| eval Z=Y-X
| chart values(X) over Z | transpose

Here we are getting Z from the total value(Y) minus field value(X).

I hope this will help you.

Thanks
KV
If any of my replies help you to solve the problem Or gain knowledge, an upvote would be appreciated.

[V21MGharib]

That's what I've done exactly. I couldn't find any other way.

Thank You.