Dashboards & Visualizations

plotting using data across multiple indexes

nekbote
Path Finder

index=index1 | stats sum(feild1) as totalAmount1
index=index 2| stats sum(feild2) as totalAmount2
index=index 3| stats sum(feild3) as totalAmount3

I need to display data from above 3 searches in the form of pie chart. Each pie section corresponds to each of the totals

piechart=piesection1 should correspond to totalAmount1 +
piesection2 should correspond to totalAmount2 +
piesection3 should correspond to totalAmount3

Can you please guide me as to how this can be performed.

Please note the filed1,field2 & field3 are not common across indexes each of those represent order amount for that index.

Can you guide me as to how this can be achieved

thanks!

1 Solution

aljohnson_splun
Splunk Employee
Splunk Employee

Try something like this:

index=index1 OR index=index2 OR index=index3
| fields field1, field2, field3, index
| eval grouped_fields = coalesce(field1, field2, field3)
| chart sum(grouped_fields) by index

Then just go to the visualization drop down and select the pie.


So what's actually happening ? Rather than thinking about this as three seperate searches, we go ahead and specify all the indexes we might search for and all the fields we are interested in the first two lines:

index=index1 OR index=index2 OR index=index3
| fields field1, field2, field3, index

Next, we use eval to push all those fields into one field. Now this seems counterintuitive but the reason that it works is because we can still use their values for the index field to keep them distinct. Grouping them together just allows us to push them all into the same sum() function. coalesce() here is taking any number of arguments and returning the whichever is not null.

| eval grouped_fields = coalesce(field1, field2, field3)

Lastly, you can use chart (or stats if you want) to get the sum, splitting by index. One last thing you could do, would be rename the indexes to what ever they might be representing.

View solution in original post

aljohnson_splun
Splunk Employee
Splunk Employee

Try something like this:

index=index1 OR index=index2 OR index=index3
| fields field1, field2, field3, index
| eval grouped_fields = coalesce(field1, field2, field3)
| chart sum(grouped_fields) by index

Then just go to the visualization drop down and select the pie.


So what's actually happening ? Rather than thinking about this as three seperate searches, we go ahead and specify all the indexes we might search for and all the fields we are interested in the first two lines:

index=index1 OR index=index2 OR index=index3
| fields field1, field2, field3, index

Next, we use eval to push all those fields into one field. Now this seems counterintuitive but the reason that it works is because we can still use their values for the index field to keep them distinct. Grouping them together just allows us to push them all into the same sum() function. coalesce() here is taking any number of arguments and returning the whichever is not null.

| eval grouped_fields = coalesce(field1, field2, field3)

Lastly, you can use chart (or stats if you want) to get the sum, splitting by index. One last thing you could do, would be rename the indexes to what ever they might be representing.

nekbote
Path Finder

@ aljohnson_splunk---Thanks alot for the quick response and it worked like a charm, i have been trying it out all day and your direction solved it in a minute...thank you again!!

0 Karma
Get Updates on the Splunk Community!

How to Monitor Google Kubernetes Engine (GKE)

We’ve looked at how to integrate Kubernetes environments with Splunk Observability Cloud, but what about ...

Index This | How can you make 45 using only 4?

October 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Splunk Education Goes to Washington | Splunk GovSummit 2024

If you’re in the Washington, D.C. area, this is your opportunity to take your career and Splunk skills to the ...