Dashboards & Visualizations

Unable to create Pie Chart with desired field colors

ak9092
Path Finder

Hi Guys,

I am trying to create pie chart with below query but unfortunately i am not getting desired result.

sourcetype="web_ping" website_monitoring_search_index title=| fillnull value=1000 response_code | eval success=case(response_code>=400, 0, timed_out == "True", 0, response_code="", 0) | fillnull value=1 success |stats count as total, sum(success) as successes by title| eval availability=round(100(successes/total),2) |eval failures=(100-'availability')| eval result=availability + " - " + failures|stats count by title result

What I am looking for is Pie chart to have 2 colors i.e. Availability should be in green and Failures should be shown in red and distributed according to their percent values in the pie.

I did trial and error with below xml but it did not work

    <option name="charting.legend.labels">[availability,failures]</option>
    <option name="charting.seriesColors">[#00ff00,#ff0006]</option>
    <option name="charting.fieldColors">{"availability":#00ff00 "failures":#ff0006}</option>

Currently I am getting output in below format with my above query -

title result count
abc 100.00 - 0.00 1
xyz 96.67 - 3.33 1
pqr 91.00 - 9.00 1

Can someone please help me figure out the right way to do this

Thanks in advance.

1 Solution

to4kawa
Ultra Champion

Check your result: (Viz> Pie Chart with trellis)

| makeresults 
| eval _raw="title,result,count
abc,100.00 - 0.00,1
xyz,96.67 - 3.33,1
pqr,91.00 - 9.00,1"
| multikv forceheader=1
| table title,result,count
| eval availability=mvindex(split(result," "),0), failures=mvindex(split(result," "),-1)
| table  title availability failures
| transpose header_field=title column_name=status
| stats values(*) as * by status

Recommend:

sourcetype="web_ping" `website_monitoring_search_index` title= 
| fillnull value=1000 response_code 
| eval success=case(response_code>=400, 0, timed_out == "True", 0, response_code="", 0) 
| fillnull value=1 success 
| stats count as total, sum(success) as successes by title 
| eval availability=round(100(successes/total),2) 
| eval failures=(100-'availability') 
| table title availability failures 
| transpose header_field=title column_name=status 
| stats values(*) as * by status

Change color as you like.

View solution in original post

to4kawa
Ultra Champion

Check your result: (Viz> Pie Chart with trellis)

| makeresults 
| eval _raw="title,result,count
abc,100.00 - 0.00,1
xyz,96.67 - 3.33,1
pqr,91.00 - 9.00,1"
| multikv forceheader=1
| table title,result,count
| eval availability=mvindex(split(result," "),0), failures=mvindex(split(result," "),-1)
| table  title availability failures
| transpose header_field=title column_name=status
| stats values(*) as * by status

Recommend:

sourcetype="web_ping" `website_monitoring_search_index` title= 
| fillnull value=1000 response_code 
| eval success=case(response_code>=400, 0, timed_out == "True", 0, response_code="", 0) 
| fillnull value=1 success 
| stats count as total, sum(success) as successes by title 
| eval availability=round(100(successes/total),2) 
| eval failures=(100-'availability') 
| table title availability failures 
| transpose header_field=title column_name=status 
| stats values(*) as * by status

Change color as you like.

ak9092
Path Finder

That's working perfectly!! Thanks a lot for your help.

0 Karma
Get Updates on the Splunk Community!

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...

Splunkbase | Splunk Dashboard Examples App for SimpleXML End of Life

The Splunk Dashboard Examples App for SimpleXML will reach end of support on Dec 19, 2024, after which no new ...

Understanding Generative AI Techniques and Their Application in Cybersecurity

Watch On-Demand Artificial intelligence is the talk of the town nowadays, with industries of all kinds ...