Dashboards & Visualizations

How to make a pie chart in Splunk?

zacksoft
Contributor

I am creating a pie chart and this should contain two pieces . One piece should contain, "How much percentage of the entire logs contain the word "abend890" and the second piece should contain the "rest of the logs that do not contain that word"

I am trying something like below, it won't work.

host="All_Error_Logs" 
| eval word=case(like(_raw,"%abend890%"),"abend890",like(_raw, NOT"%abend890%"),"NOT_ABEND890")
| stats count by word
0 Karma
1 Solution

renjith_nair
Legend

Hi @zacksoft,

It would be more faster if you could extract the field and do a percentage on that. However, this should work for your above requirement.

host="All_Error_Logs" |stats count(eval(match(_raw,"abend890"))) as abend890,count(eval(NOT match(_raw,"abend890"))) as "NOT_abend890",count as total
|eval match_perc=round((abend890/total)*100,2),not_match_perc=round((NOT_abend890/total)*100,2)
---
What goes around comes around. If it helps, hit it with Karma 🙂

View solution in original post

0 Karma

renjith_nair
Legend

Hi @zacksoft,

It would be more faster if you could extract the field and do a percentage on that. However, this should work for your above requirement.

host="All_Error_Logs" |stats count(eval(match(_raw,"abend890"))) as abend890,count(eval(NOT match(_raw,"abend890"))) as "NOT_abend890",count as total
|eval match_perc=round((abend890/total)*100,2),not_match_perc=round((NOT_abend890/total)*100,2)
---
What goes around comes around. If it helps, hit it with Karma 🙂
0 Karma

zacksoft
Contributor

will it not be required to add asterisk(*) before and after abend890 in the eval match statement?

0 Karma

renjith_nair
Legend

This function compares the regex string REGEX to the value of SUBJECT and returns a Boolean value. It returns TRUE if the REGEX can find a match against any substring of SUBJECT. You could test it with simple search

    index=_internal sourcetype="splunkd*"|stats count by sourcetype|stats count(eval(match(sourcetype,"access"))) as "web" ,  count(eval(NOT match(sourcetype,"access"))) as "Not Web"
---
What goes around comes around. If it helps, hit it with Karma 🙂
0 Karma

pradeepkumarg
Influencer
| eval word=if(searchmatch("\*abend890\*"), "ABEND", "NOT_ABEND") | stats count by word 

zacksoft
Contributor

Thanks for the response.
I am bit confused whether to use ("abend") or ("#abend#")

My sample logs are like this
1. fdjihfklsdfjsdhgrfgkjsdflk*abend890iofjsdfjs
2. shshffsjjfmi
crosoft.abend890.erase*,hhhhfjksdzfhskjfhskdjfhsk

0 Karma
Get Updates on the Splunk Community!

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Announcing the General Availability of Splunk Enterprise Security 8.1!

We are pleased to announce the general availability of Splunk Enterprise Security 8.1. Splunk becomes the only ...

Developer Spotlight with William Searle

The Splunk Guy: A Developer’s Path from Web to Cloud William is a Splunk Professional Services Consultant with ...