Dashboards & Visualizations

Pie chart to display upgrade adoption of our new app version based on fields


I am trying to track a a version upgrade rollout of an application in our environment. I would like to see a pie graph showing percentage of the old version verses the new version. The index and sourcetype are the same ( index=fee sourcetype=events). However, the versions of the upgrade are in 2 different fields ( AgentVersionold=9.3 AgentVersionnew=10.0) . How can get this info a pie graph? Thanks

0 Karma

Splunk Employee
Splunk Employee

You could use the coalesce command to merge the two fields into a single field:

BASE SEARCH | eval AgentVersion = coalesce(AgentVersionold,AgentVersionnew) | stats count by AgentVersion

index=fee sourcetype=events
| eval AgentVersion=coalesce(AgentVersionold, AgentVersionnew, 0.0)
| stats count by AgentVersion