Dashboards & Visualizations

Unable to create Pie Chart with desired field colors

ak9092
Path Finder

Hi Guys,

I am trying to create pie chart with below query but unfortunately i am not getting desired result.

sourcetype="web_ping" website_monitoring_search_index title=| fillnull value=1000 response_code | eval success=case(response_code>=400, 0, timed_out == "True", 0, response_code="", 0) | fillnull value=1 success |stats count as total, sum(success) as successes by title| eval availability=round(100(successes/total),2) |eval failures=(100-'availability')| eval result=availability + " - " + failures|stats count by title result

What I am looking for is Pie chart to have 2 colors i.e. Availability should be in green and Failures should be shown in red and distributed according to their percent values in the pie.

I did trial and error with below xml but it did not work

    <option name="charting.legend.labels">[availability,failures]</option>
    <option name="charting.seriesColors">[#00ff00,#ff0006]</option>
    <option name="charting.fieldColors">{"availability":#00ff00 "failures":#ff0006}</option>

Currently I am getting output in below format with my above query -

title result count
abc 100.00 - 0.00 1
xyz 96.67 - 3.33 1
pqr 91.00 - 9.00 1

Can someone please help me figure out the right way to do this

Thanks in advance.

1 Solution

to4kawa
Ultra Champion

Check your result: (Viz> Pie Chart with trellis)

| makeresults 
| eval _raw="title,result,count
abc,100.00 - 0.00,1
xyz,96.67 - 3.33,1
pqr,91.00 - 9.00,1"
| multikv forceheader=1
| table title,result,count
| eval availability=mvindex(split(result," "),0), failures=mvindex(split(result," "),-1)
| table  title availability failures
| transpose header_field=title column_name=status
| stats values(*) as * by status

Recommend:

sourcetype="web_ping" `website_monitoring_search_index` title= 
| fillnull value=1000 response_code 
| eval success=case(response_code>=400, 0, timed_out == "True", 0, response_code="", 0) 
| fillnull value=1 success 
| stats count as total, sum(success) as successes by title 
| eval availability=round(100(successes/total),2) 
| eval failures=(100-'availability') 
| table title availability failures 
| transpose header_field=title column_name=status 
| stats values(*) as * by status

Change color as you like.

View solution in original post

to4kawa
Ultra Champion

Check your result: (Viz> Pie Chart with trellis)

| makeresults 
| eval _raw="title,result,count
abc,100.00 - 0.00,1
xyz,96.67 - 3.33,1
pqr,91.00 - 9.00,1"
| multikv forceheader=1
| table title,result,count
| eval availability=mvindex(split(result," "),0), failures=mvindex(split(result," "),-1)
| table  title availability failures
| transpose header_field=title column_name=status
| stats values(*) as * by status

Recommend:

sourcetype="web_ping" `website_monitoring_search_index` title= 
| fillnull value=1000 response_code 
| eval success=case(response_code>=400, 0, timed_out == "True", 0, response_code="", 0) 
| fillnull value=1 success 
| stats count as total, sum(success) as successes by title 
| eval availability=round(100(successes/total),2) 
| eval failures=(100-'availability') 
| table title availability failures 
| transpose header_field=title column_name=status 
| stats values(*) as * by status

Change color as you like.

ak9092
Path Finder

That's working perfectly!! Thanks a lot for your help.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...