Dashboards & Visualizations

plotting using data across multiple indexes

nekbote
Path Finder

index=index1 | stats sum(feild1) as totalAmount1
index=index 2| stats sum(feild2) as totalAmount2
index=index 3| stats sum(feild3) as totalAmount3

I need to display data from above 3 searches in the form of pie chart. Each pie section corresponds to each of the totals

piechart=piesection1 should correspond to totalAmount1 +
piesection2 should correspond to totalAmount2 +
piesection3 should correspond to totalAmount3

Can you please guide me as to how this can be performed.

Please note the filed1,field2 & field3 are not common across indexes each of those represent order amount for that index.

Can you guide me as to how this can be achieved

thanks!

1 Solution

aljohnson_splun
Splunk Employee
Splunk Employee

Try something like this:

index=index1 OR index=index2 OR index=index3
| fields field1, field2, field3, index
| eval grouped_fields = coalesce(field1, field2, field3)
| chart sum(grouped_fields) by index

Then just go to the visualization drop down and select the pie.


So what's actually happening ? Rather than thinking about this as three seperate searches, we go ahead and specify all the indexes we might search for and all the fields we are interested in the first two lines:

index=index1 OR index=index2 OR index=index3
| fields field1, field2, field3, index

Next, we use eval to push all those fields into one field. Now this seems counterintuitive but the reason that it works is because we can still use their values for the index field to keep them distinct. Grouping them together just allows us to push them all into the same sum() function. coalesce() here is taking any number of arguments and returning the whichever is not null.

| eval grouped_fields = coalesce(field1, field2, field3)

Lastly, you can use chart (or stats if you want) to get the sum, splitting by index. One last thing you could do, would be rename the indexes to what ever they might be representing.

View solution in original post

aljohnson_splun
Splunk Employee
Splunk Employee

Try something like this:

index=index1 OR index=index2 OR index=index3
| fields field1, field2, field3, index
| eval grouped_fields = coalesce(field1, field2, field3)
| chart sum(grouped_fields) by index

Then just go to the visualization drop down and select the pie.


So what's actually happening ? Rather than thinking about this as three seperate searches, we go ahead and specify all the indexes we might search for and all the fields we are interested in the first two lines:

index=index1 OR index=index2 OR index=index3
| fields field1, field2, field3, index

Next, we use eval to push all those fields into one field. Now this seems counterintuitive but the reason that it works is because we can still use their values for the index field to keep them distinct. Grouping them together just allows us to push them all into the same sum() function. coalesce() here is taking any number of arguments and returning the whichever is not null.

| eval grouped_fields = coalesce(field1, field2, field3)

Lastly, you can use chart (or stats if you want) to get the sum, splitting by index. One last thing you could do, would be rename the indexes to what ever they might be representing.

nekbote
Path Finder

@ aljohnson_splunk---Thanks alot for the quick response and it worked like a charm, i have been trying it out all day and your direction solved it in a minute...thank you again!!

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...