Dashboards & Visualizations

I want to create pie chart with two slides

Aj01
Path Finder

I need help in making the pie chart and put two pie's in it with one as success_transaction and other as error_transaction, when i am doing it, it is showing consolidated data with service name, also i would need to put count inside those pie's and provide a Y Axis title wiht those fields names,

i was using this query, please help me into solving this problem

index="aio" Environment="POD" Appid="APP-53" ("Invokema : call() :") OR ("exception" OR level="ERROR" NOT "NOT RACT" NOT H0 NOT "N is null" NOT "[null" NOT "lid N")
| rex field=_raw "00\s(?<service_name>\w+)-pod"
| rex field=_raw "]\s(?<valid_by>.*?)\s\:\scall()"
| eval success_flag = if(valid_by="Invokema", 1,0)
| fillnull validate_by value=null
| fillnull service_name value=nservice
| eval error_flag = if(valid_by="null", 1,0)
| stats sum(success_flag) as Success_Transaction, sum(error_flag) as Error_Transaction by service_name

 

you help will be appreciated.

Labels (3)
0 Karma

KulvinderSingh
Path Finder

club the success and Error under a single field say "results" or "action" and then you should be able to get the 2 values in a pie chart.

0 Karma

bowesmana
SplunkTrust
SplunkTrust

You can't put two datasets into a single pie chart when split by service_name as you have 2 lots of 100% (errors and success).

You can show this as a trellis view, which will then show two pie charts, one for success and the other for errors.

 

0 Karma

Aj01
Path Finder

cant we update this query in some way to get both the results in one pie, when using trells it is giving two piechart, which is not helpful.

0 Karma

bowesmana
SplunkTrust
SplunkTrust

If you think of the data that is needed for a pie chart, you need

Service        Success       Fail
service 1          200          2
service 2          400         17
service 3          600         44

so the pie chart will only show 3 segments for Success, service 1 is approx 16% of the pie, service 2 is 33% and service 3 is 50%

So, if you put Failures into the pie, how are you expecting to visualise that, as you would then get 6 segments, 2 for each service, one large one with successes and one small one with failures.

Now Success is just a column of numbers and Service 1 failures is (2/1263*100), so approx 0.15% which is too small a slice to show on the pie chart. Splunk by default will aggregate small slices.

You can mangle data in any way you want in Splunk to get where you want to get to. 

 

Aj01
Path Finder

Could you help me to make only 2 slices with only success and failures as i will not be needing services column, it is only working on one service and just providing name for the need of bargraph, we wont be needing service name, it is not useful , i just need success and failure in piechart

 

0 Karma

bowesmana
SplunkTrust
SplunkTrust

Just make status indicate success of fail and then do this

...
| fillnull validate_by value=null
| eval status = case(valid_by="Invokema", 1,valid_by="null", 0, true(), -1)
| stats count by status
0 Karma
Get Updates on the Splunk Community!

Tech Talk | Elevating Digital Service Excellence: The Synergy of Splunk RUM & APM

Elevating Digital Service Excellence: The Synergy of Real User Monitoring and Application Performance ...

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

March Community Office Hours Security Series Uncovered!

Hello Splunk Community! In March, Splunk Community Office Hours spotlighted our fabulous Splunk Threat ...