Dashboards & Visualizations

how to show data in one pie chart from different splunk search result

neha_h
Explorer

I have below splunk events / search result:-
message: host id :undefined, test Id :"42342424-8bf9-4abdc", msg : processing test data
message: host id :undefined, test Id :"4eee2ab1-8bf9-4abdc", msg : data processing for test
message: host id :undefined, test Id :"5eee2ab1-8bf9-43434", msg : data processing for test
message: host id :undefined, test Id :"4234244-3339-4abdc", msg : processing test data
message: host id :undefined, test Id :"4ujuj-8bf9-qwqweees", msg : data processing for test1
message: host id :undefined, test Id :"4tft-8bf9-hjhheeessss", msg : data processing for test1
extras-path: /v1/test-data/test-update

I want to show the data in pie chart, so it should show 3 slice in 1 pie chart basically based on the msg part
so 2 count for data processing for test and 2 count for data processing for test1 and 1 count for this path
Actually i am not sure how to evaluate msg key and how to display 3 different result in 1 pie-chat . plz anyone can help.

Tags (1)
0 Karma

to4kawa
Ultra Champion
| makeresults 
| eval _raw="message: host id :undefined, test Id :\"4eee2ab1-8bf9-4abdc\", msg : data processing for test
message: host id :undefined, test Id :\"5eee2ab1-8bf9-43434\", msg : data processing for test
message: host id :undefined, test Id :\"4ujuj-8bf9-qwqweees\", msg : data processing for test1
message: host id :undefined, test Id :\"4tft-8bf9-hjhheeessss\", msg : data processing for test2" 
| multikv noheader=t 
| fields _raw 
| rename COMMENT as "from here, the logic" 
| rex "msg : (?<msg>.*)" 
| stats count by msg
  1. extract msg field
  2. aggregate by stats
  3. display on Pie Chart
0 Karma

neha_h
Explorer

@to4Kawa, but test Id is the random number generated unique everytime, I can't give any specific id in the search query. I just want to extract msg part which starts with "data processing"

0 Karma

to4kawa
Ultra Champion

use rex field=msg

0 Karma

neha_h
Explorer

Not working , i have updated my question with more details, I tried this but no luck:
index="testing" application="test-data" | rex field=msg

0 Karma

to4kawa
Ultra Champion
0 Karma
Get Updates on the Splunk Community!

Splunk Search APIを使えば調査過程が残せます

   このゲストブログは、JCOM株式会社の情報セキュリティ本部・専任部長である渡辺慎太郎氏によって執筆されました。 Note: This article is published in both Japanese ...

Integrating Splunk Search API and Quarto to Create Reproducible Investigation ...

 Splunk is More Than Just the Web Console For Digital Forensics and Incident Response (DFIR) practitioners, ...

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...