Dashboards & Visualizations

Pie chart of multi rows

preben12
Communicator

I have the following search

index="surveillance-status" source="rest://drip status" OR source="rest://drip-status2" | stats count by source, status

It gives me 4 rows with the fields source, status and a count for each, since the status can be either OK or ERROR

How can i turn this into a pie chart that shows a slice fore each source by statusalt text

Tags (1)
0 Karma
1 Solution

preben12
Communicator

Will answer this my self.

I just did
index="surveillance-status" source="rest://drip status" OR source="rest://drip-status2" | chart count by source, status

View solution in original post

0 Karma

preben12
Communicator

Will answer this my self.

I just did
index="surveillance-status" source="rest://drip status" OR source="rest://drip-status2" | chart count by source, status

0 Karma
Get Updates on the Splunk Community!

Index This | When is October more than just the tenth month?

October 2025 Edition  Hayyy Splunk Education Enthusiasts and the Eternally Curious!   We’re back with this ...

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

What’s New & Next in Splunk SOAR

 Security teams today are dealing with more alerts, more tools, and more pressure than ever.  Join us for an ...