Dashboards & Visualizations

how to show data in one pie chart from different splunk search result

neha_h
Explorer

I have below splunk events / search result:-
message: host id :undefined, test Id :"42342424-8bf9-4abdc", msg : processing test data
message: host id :undefined, test Id :"4eee2ab1-8bf9-4abdc", msg : data processing for test
message: host id :undefined, test Id :"5eee2ab1-8bf9-43434", msg : data processing for test
message: host id :undefined, test Id :"4234244-3339-4abdc", msg : processing test data
message: host id :undefined, test Id :"4ujuj-8bf9-qwqweees", msg : data processing for test1
message: host id :undefined, test Id :"4tft-8bf9-hjhheeessss", msg : data processing for test1
extras-path: /v1/test-data/test-update

I want to show the data in pie chart, so it should show 3 slice in 1 pie chart basically based on the msg part
so 2 count for data processing for test and 2 count for data processing for test1 and 1 count for this path
Actually i am not sure how to evaluate msg key and how to display 3 different result in 1 pie-chat . plz anyone can help.

Tags (1)
0 Karma

to4kawa
Ultra Champion
| makeresults 
| eval _raw="message: host id :undefined, test Id :\"4eee2ab1-8bf9-4abdc\", msg : data processing for test
message: host id :undefined, test Id :\"5eee2ab1-8bf9-43434\", msg : data processing for test
message: host id :undefined, test Id :\"4ujuj-8bf9-qwqweees\", msg : data processing for test1
message: host id :undefined, test Id :\"4tft-8bf9-hjhheeessss\", msg : data processing for test2" 
| multikv noheader=t 
| fields _raw 
| rename COMMENT as "from here, the logic" 
| rex "msg : (?<msg>.*)" 
| stats count by msg
  1. extract msg field
  2. aggregate by stats
  3. display on Pie Chart
0 Karma

neha_h
Explorer

@to4Kawa, but test Id is the random number generated unique everytime, I can't give any specific id in the search query. I just want to extract msg part which starts with "data processing"

0 Karma

to4kawa
Ultra Champion

use rex field=msg

0 Karma

neha_h
Explorer

Not working , i have updated my question with more details, I tried this but no luck:
index="testing" application="test-data" | rex field=msg

0 Karma

to4kawa
Ultra Champion
0 Karma
Get Updates on the Splunk Community!

Community Content Calendar, November Edition

Welcome to the November edition of our Community Spotlight! Each month, we dive into the Splunk Community to ...

October Community Champions: A Shoutout to Our Contributors!

As October comes to a close, we want to take a moment to celebrate the people who make the Splunk Community ...

Stay Connected: Your Guide to November Tech Talks, Office Hours, and Webinars!

What are Community Office Hours? Community Office Hours is an interactive 60-minute Zoom series where ...