Dashboards & Visualizations

Pie Chart AppendCol Data

fbond_diligent
Engager

I have successfully used appendcol to gather percentage of successful and failed scans. I would like to make this data into a pie chart for my dashboard. 

When I click visualization-> pie chart it is all one color. 

 

Here is my search 

 

index="secops" sourcetype="tenable:sc:vuln" plugin_id=19506 pluginText!="*Host_Scan*" | dedup ip | search pluginText="*Credentialed checks : no*" | stats count(plugin_id) as failed_scans | appendcols [search index="secops" sourcetype="tenable:sc:vuln" plugin_id=19506 pluginText!="*Host_Scan*" | dedup ip | search pluginText="*Credentialed checks : yes*" | stats count(plugin_id) as successful_scans] | eval total_scans=(failed_scans+successful_scans) | eval failed_percent=(failed_scans/total_scans*100) | eval failed_percent=round(failed_percent,2) | eval success_percent=(successful_scans/total_scans*100) | eval success_percent=round(success_percent,2) | table success_percent failed_percent

 

 

Thank you in advanced. 

Labels (1)
0 Karma

niketn
Legend

[Updated]
Corrected typo for match() condition which does not need *

___________________________

@fbond_diligent  as your final pipe if you add transpose command it should show Pie chart (convert result columns to rows).

 

| transpose

 

However, there are a lot of performance steps that you need to adopt. https://docs.splunk.com/Documentation/Splunk/8.0.5/Search/Writebettersearches

  1. Filter only required events from index based on pluginText as yes and no.
  2. Perform stats using specific fields to deduplicate instead dedup with all the fields.
  3. Avoid subsearch as it introduces sub-search limitations (which may drop events if you hit limit).
  4. Chain eval as single eval for performance and simple code.

 

 

index="secops" sourcetype="tenable:sc:vuln" plugin_id=19506 pluginText!="*Host_Scan*" pluginText IN ("*Credentialed checks : yes*","*Credentialed checks : no*") 
| stats count as total_scans count(eval(match(pluginText,"Credentialed checks : no"))) as failed_scans count(eval(match(pluginText,"Credentialed checks : yes"))) as successful_scans by ip 
| stats sum(*_scans) as *_scans 
| eval failed_percent=round((failed_scans/total_scans*100),2), success_percent=round((success_percent/total_scans*100),2) 
| fields success_percent failed_percent 
| transpose 0 header_field="status" 
| rename "row 1" as percent

 

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

fbond_diligent
Engager

@niketn 

Thank you for your reply, I will take a look at the website your provided. 

However when I try your search I am getting the following error:

Error in 'stats' command: The eval expression for dynamic field 'eval(match(pluginText,"*Credentialed checks : no*"))' is invalid. Error='Regex: quantifier does not follow a repeatable item'.

 

Thank you,

 

Rick

0 Karma

niketn
Legend

@fbond_diligent sorry for the copy paste issue. match() condition is regex based. So * is not required. Please check updated SPL.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Get the T-shirt to Prove You Survived Splunk University Bootcamp

As if Splunk University, in Las Vegas, in-person, with three days of bootcamps and labs weren’t enough, now ...

Wondering How to Build Resiliency in the Cloud?

IT leaders are choosing Splunk Cloud as an ideal cloud transformation platform to drive business resilience,  ...