Dashboards & Visualizations

How to make a pie chart in Splunk?

zacksoft
Contributor

I am creating a pie chart and this should contain two pieces . One piece should contain, "How much percentage of the entire logs contain the word "abend890" and the second piece should contain the "rest of the logs that do not contain that word"

I am trying something like below, it won't work.

host="All_Error_Logs" 
| eval word=case(like(_raw,"%abend890%"),"abend890",like(_raw, NOT"%abend890%"),"NOT_ABEND890")
| stats count by word
0 Karma
1 Solution

renjith_nair
SplunkTrust
SplunkTrust

Hi @zacksoft,

It would be more faster if you could extract the field and do a percentage on that. However, this should work for your above requirement.

host="All_Error_Logs" |stats count(eval(match(_raw,"abend890"))) as abend890,count(eval(NOT match(_raw,"abend890"))) as "NOT_abend890",count as total
|eval match_perc=round((abend890/total)*100,2),not_match_perc=round((NOT_abend890/total)*100,2)
Happy Splunking!

View solution in original post

0 Karma

renjith_nair
SplunkTrust
SplunkTrust

Hi @zacksoft,

It would be more faster if you could extract the field and do a percentage on that. However, this should work for your above requirement.

host="All_Error_Logs" |stats count(eval(match(_raw,"abend890"))) as abend890,count(eval(NOT match(_raw,"abend890"))) as "NOT_abend890",count as total
|eval match_perc=round((abend890/total)*100,2),not_match_perc=round((NOT_abend890/total)*100,2)
Happy Splunking!
0 Karma

zacksoft
Contributor

will it not be required to add asterisk(*) before and after abend890 in the eval match statement?

0 Karma

renjith_nair
SplunkTrust
SplunkTrust

This function compares the regex string REGEX to the value of SUBJECT and returns a Boolean value. It returns TRUE if the REGEX can find a match against any substring of SUBJECT. You could test it with simple search

    index=_internal sourcetype="splunkd*"|stats count by sourcetype|stats count(eval(match(sourcetype,"access"))) as "web" ,  count(eval(NOT match(sourcetype,"access"))) as "Not Web"
Happy Splunking!
0 Karma

pradeepkumarg
Influencer
| eval word=if(searchmatch("\*abend890\*"), "ABEND", "NOT_ABEND") | stats count by word 

zacksoft
Contributor

Thanks for the response.
I am bit confused whether to use ("abend") or ("#abend#")

My sample logs are like this
1. fdjihfklsdfjsdhgrfgkjsdflk*abend890iofjsdfjs
2. shshffsjjfmi
crosoft.abend890.erase*,hhhhfjksdzfhskjfhskdjfhsk

0 Karma
Get Updates on the Splunk Community!

Using Machine Learning for Hunting Security Threats

WATCH NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more for ...

New Learning Videos on Topics Most Requested by You! Plus This Month’s New Splunk ...

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

How I Instrumented a Rust Application Without Knowing Rust

As a technical writer, I often have to edit or create code snippets for Splunk's distributions of ...