how to do a pie chart

[fzfeng]

hello guys

I want to make a pie chart of mail size for one mouth

if my record is wrong？

index=maillog I stats count （eval（size＜1024））as count1 ，count（eval（size＞1024 and size＜2048））
as count2，count（eval（size＜1024）））as count3

if you know it can you tell me thanks

[niketn]

@fzfeng, if you want count based on various size data taken for a month you can try one of the following:
Option 1: Using transpose command

 index=maillog size=*
| stats count(eval(size<1024)) as "<1024" count(eval(size>1024 AND size<2048)) as "1024> & <2028"  count(eval(size>2048)) as ">2048"
| transpose column_name="size_range"
| rename "row 1" as count

Option 2: Using stats on range

index=maillog size=*
| stats count by size
| eval size_range=case((size<1024),"<1024",(size>1024 AND size<2048),"1024> & <2028",(size>2048),">2048")
| stats count by size_range

Please try out and confirm!

[p_gurav]

This may help:

http://docs.splunk.com/Documentation/Splunk/7.0.3/SearchReference/ConditionalFunctions#validate.28X....