How to pass values from search results into a pie chart?

[jgbricker]

I want to show a pie chart with the percentage values. Here is my search -

index="rp" sourcetype="rp" *PartOfURL*  
| rex "\-\s+(?<Agent>\w{2}\d{4}\w\d{2})\s[^\"]+\"(?<request>GET\s[^\"]+)\"\s(?<status_code>\d{3})\s[^\"]+\"(?<referer>[^\"]+)"  
| lookup quoteLaunchBeta.csv betaAgent AS Agent OUTPUT betaAgent AS BetaAgent  
| where isnotnull(BetaAgent)  
| regex request!="GET\s\/PartOfURL\/[^\/]+\/[^\/]+\/[^\s]+\sHTTP[^\"]+"  
| search (request="GET /PartOfURL/ HTTP/1.1" AND referer="https://www.someplace.com/Pages/default.aspx") OR (request="GET /PartOfURL/g/*" AND referer="*Customer*") 
| stats  count(eval(request!="GET /PartOfURL/ HTTP/1.1")) as ConformCount, count(eval(request="GET /PartOfURL/ HTTP/1.1")) as NotConformCount

I see the output of the different numbers but the Visual isn't working - it is a solid blue circle and is evaluating NotConform%=100

Any help is much appreciated!

[jgbricker · Accepted solution]

Thanks for the tip! Your answer was very close to what I wanted. One of the requests contains a session GUID so it was breaking it out funny when I tested your suggested method.

The search that found what I wanted was

index="my_index" sourcetype="my_index" *PartOfURL*  
| rex "\-\s+(?<Agent>\w{2}\d{4}\w\d{2})\s[^\"]+\"(?<request>GET\s[^\"]+)\"\s(?<status_code>\d{3})\s[^\"]+\"(?<referer>[^\"]+)"  
| lookup quoteLaunchBeta.csv betaAgent AS Agent OUTPUT betaAgent AS BetaAgent 
| where isnotnull(BetaAgent) 
| regex request!="GET\s\/PartOfURL\/[^\/]+\/[^\/]+\/[^\s]+\sHTTP[^\"]+" 
| search (request="GET /PartOfURL/ HTTP/1.1" AND referer="https://www.somewhere.com/Pages/default.aspx") OR (request="GET /PartOfURL/g/*" AND referer="*Customer*") 
| eval ConformValue = case(request!="GET /PartOfURL/ HTTP/1.1", "ConformRequest", request="GET /PartOfURL/ HTTP/1.1", "NotConformRequest") 
| stats count by ConformValue

[fdi01]

retried by adding "by request | top request" like the following
because you don t have to calculate the percentage and you veus show how?

index="rp" sourcetype="rp" PartOfURL | rex "-\s+(?\w{2}\d{4}\w\d{2})\s[^\"]+\"(?GET\s[^\"]+)\"\s(?\d{3})\s[^\"]+\"(?[^\"]+)" | lookup quoteLaunchBeta.csv betaAgent AS Agent OUTPUT betaAgent AS BetaAgent | where isnotnull(BetaAgent) | regex request!="GET\s\/PartOfURL\/[^\/]+\/[^\/]+\/[^\s]+\sHTTP[^\"]+" | search (request="GET /PartOfURL/ HTTP/1.1" AND referer="https://www.someplace.com/Pages/default.aspx") OR (request="GET /PartOfURL/g/" AND referer="*Customer") | stats count(eval(request!="GET /PartOfURL/ HTTP/1.1")) as ConformCount, count(eval(request="GET /PartOfURL/ HTTP/1.1")) as NotConformCount by request| top request

and your piechar to display only what you ask him you must calculate the percentage of what you veus Display High front of Display High using eval
see this exple:
index=_internal | head 5 | eval value=1 | eventstats sum(value) as total | streamstats window=0 sum(value) as sumvalue | eval percentage=(sumvalue*100/total) | table value,sumvalue,total,percentage
please forgive my english.