Dashboards & Visualizations

how to bring a row values to category in pie chart

umsundar2015
Path Finder

I want to explain in detail ,

I have the following search

index=segment|stats sum(Link_CVE_Asset_CVSS_Environmental) as CVSS sum(eval(if(Link_CVE_Asset_Flags=="NULL" AND Bulletin!="NULL",Link_CVE_Asset_CVSS_Environmental, 0))) as "OS Score " sum(eval(if(Bulletin=="NULL" AND Link_CVE_Asset_Flags!="NULL", Link_CVE_Asset_CVSS_Environmental, 0))) as "App Score " by os_name

This search will give the results like ,
OS_name OS Score App score
windows 2223445(score) 1284665
linux 349480(score) 4545
unix 34333(score) 75214

Now i need to bring this osscoreand and appscore in categories in pie chart .The pie chart will show like percentage of os_name with percent values .Here i need this two osscoreand and appscore also like os_name in pie chart.

Please help me

Tags (1)
0 Karma
1 Solution

somesoni2
Revered Legend

How about this

index=segment|stats sum(Link_CVE_Asset_CVSS_Environmental) as CVSS sum(eval(if(Link_CVE_Asset_Flags=="NULL" AND Bulletin!="NULL",Link_CVE_Asset_CVSS_Environmental, 0))) as "OS Score " sum(eval(if(Bulletin=="NULL" AND Link_CVE_Asset_Flags!="NULL", Link_CVE_Asset_CVSS_Environmental, 0))) as "App Score " by os_name
| eval os_name=os_name."(OS:".'OS Score'.", App:".'App Score'.")" | table os_name CVSS

View solution in original post

0 Karma

somesoni2
Revered Legend

How about this

index=segment|stats sum(Link_CVE_Asset_CVSS_Environmental) as CVSS sum(eval(if(Link_CVE_Asset_Flags=="NULL" AND Bulletin!="NULL",Link_CVE_Asset_CVSS_Environmental, 0))) as "OS Score " sum(eval(if(Bulletin=="NULL" AND Link_CVE_Asset_Flags!="NULL", Link_CVE_Asset_CVSS_Environmental, 0))) as "App Score " by os_name
| eval os_name=os_name."(OS:".'OS Score'.", App:".'App Score'.")" | table os_name CVSS
0 Karma

cmerriman
Super Champion

do you want a separate pie chart, then for OS Score and one for App Score?

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...