Splunk Dashboard to show the values in slices or any way

[phanikumarcs]

Hi Team,

I am trying to create a dashboard pie chart visualization with the spl query.
we have total_apps are 300, how many apps(count) are there out of this.
Note: why i am using "dc" here we have foo_foo_1, foo_foo_2, foo_foo_3 apps.

|rest /services/data/indexes
|rename title as index
|rex field=index "^foo_(?<appname>.+)"
|rex field=index "^foo_(?<appname>.+)_"
|table appname, index
|stats dc(appname) as currentapps
|eval currentapps = currentapps
|eval total_apps = 300

from this in pie chart its showing only total_apps or currentapps not both in single pie chart
so what is the issue. 

[phanikumarcs]

Thanks @ITWhisperer  its working for me

[phanikumarcs]

@ITWhisperer  thanks for the response,

actually, I am creating a pie chart in dashboard that will show "totalapps" count and "appname" count on pie chart in two slices.

where our totalapps is 300, and i am extracting appnames using rex.

[ITWhisperer · Accepted solution]

Try something like this

|rest /services/data/indexes
|rename title as index
|rex field=index "^foo_(?<appname>.+)"
|rex field=index "^foo_(?<appname>.+)_"
|table appname, index
|stats dc(appname) as count
|eval title = "currentapps"
| append
[| makeresults
| eval count = 300
| eval title="total_apps"]
| table title count

[phanikumarcs]

@ITWhisperer  it works buts its not showing values(digits) on pie chart

[ITWhisperer]

Numbers show up when you hover over each segment

[phanikumarcs]

So where i can change the changes in the spl or xml source @

[ITWhisperer]

What changes are you expecting - this is the way pie charts work - you could consider appending the value to the title

|rest /services/data/indexes
|rename title as index
|rex field=index "^foo_(?<appname>.+)"
|rex field=index "^foo_(?<appname>.+)_"
|table appname, index
|stats dc(appname) as count
|eval title = "currentapps: ".count
| append
[| makeresults
| eval count = 300
| eval title="total_apps: ".count]
| table title count

[phanikumarcs]

@ITWhisperer  i am expexting the same in the attached picture 

[ITWhisperer]

As you can see here, there are no configuration options for this feature

[phanikumarcs]

1) yes, this is the first approach i have take, later i posted in the community. But why its not showing the value count over chart.

2) by the way @ITWhisperer  if you have any idea please help me for this
https://community.splunk.com/t5/All-Apps-and-Add-ons/JSON-data-unexpected-value-count/m-p/677019#M80...

3)is it possible to remove the label name below colored where like "Mon Jan 15" to "Jan 15" like this. from UI or XML source or SPL

[ITWhisperer]

1) already answered - standard pie charts don't have this feature in Splunk

2) responded in thread

3) edit your dashboard panel and change the x-axis title to none

[phanikumarcs]

@ITWhisperer for this 3) edit your dashboard panel and change the x-axis title to none

I have found the solution to this issue. I applied the following SPL code to the existing SPL, and the visualization updated automatically to reflect the changes.

|timechart span=1d count
|eval Date=strftime(_time, "%m/%d")
|table Date, count

@ITWhisperer thanks for your time...

[ITWhisperer]

It is not clear what result you are expecting - please can you expand your question