Dashboards & Visualizations

help for changing the label of a pie chart

jip31
Motivator

hello
I use the stats below in order to display a pie chart with 2 labels

| stats count as NbHostHealthInf85 
| appendcols 
    [| inputlookup host.csv 
    | stats count as NbIndHost] 
| eval NbHostHealthSup85 = (NbIndHost - NbHostHealthInf85) 
| eval NbHostHealthSup85=NbHostHealthSup85, NbHostHealthInf85=NbHostHealthInf85 
| table NbHostHealthSup85 NbHostHealthInf85 
| transpose

I need to replace NbHostHealthSup85 by >85% and NbHostHealthInf85 by <85%
What is the good way to do this because I m doing for example | stats count as "<85%" but it doesnt works

Tags (1)
0 Karma
1 Solution

jitendragupta
Path Finder

Try renaming:

| stats count as NbHostHealthInf85 
 | appendcols 
     [| inputlookup host.csv 
     | stats count as NbIndHost] 
 | eval NbHostHealthSup85 = (NbIndHost - NbHostHealthInf85) 
 | eval NbHostHealthSup85=NbHostHealthSup85, NbHostHealthInf85=NbHostHealthInf85 
 | table NbHostHealthSup85 NbHostHealthInf85  
| rename NbHostHealthSup85 as ">85%", NbHostHealthInf85 as "<85%"
 | transpose

View solution in original post

0 Karma

jitendragupta
Path Finder

Try renaming:

| stats count as NbHostHealthInf85 
 | appendcols 
     [| inputlookup host.csv 
     | stats count as NbIndHost] 
 | eval NbHostHealthSup85 = (NbIndHost - NbHostHealthInf85) 
 | eval NbHostHealthSup85=NbHostHealthSup85, NbHostHealthInf85=NbHostHealthInf85 
 | table NbHostHealthSup85 NbHostHealthInf85  
| rename NbHostHealthSup85 as ">85%", NbHostHealthInf85 as "<85%"
 | transpose
0 Karma

jip31
Motivator

perfect thanks

0 Karma

snigdhasaxena
Communicator

Hi,
Since | stats count as "<85%" this will create a field named ,"<85%" and field name should not start with a relational operator hence it doesn't work. Try naming the count field as something "Lessthan85" and it will work

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Matching cron expressions

This puzzle (first published here) is based on matching timestamps to cron expressions.All the timestamps ...

Design, Compete, Win: Submit Your Best Splunk Dashboards for a .conf26 Pass

Hello Splunkers,  We’re excited to kick off a Splunk Dashboard contest! We know that dashboards are a primary ...

May 2026 Splunk Expert Sessions: Security & Observability

Level Up Your Operations: May 2026 Splunk Expert Sessions Whether you are refining your security posture or ...