hi
i hav read the docs of Splunk but still unable to solve my problem..i want to create a pie chart where there are 5 sector.4 of them are for different url(that will be chosen by me) and the other sector will consist of rest of the urls. and the name of this sector will be OTHER.. what will be the searching code?
thanx..
thnx for the answer.. but still there is a problem with it..here only the "other" part is showing in the chart.rest
of the sectors are not showing..
before charting you could do create a new field based on a eval, if it's one of the four url's it will have the url name , if that is not the case the value will be "other"
eval my_url=case(url==url1,"url1",url==url2,"url2",url==url3,"url3",url==url4,"url4",url!="url1" AND url!=url2 AND url!=url3 AND url!=url4,"other") | chart count by my_url
did that one work?
sorry, I just edited my answer, that should work now
thnx for the answer.. but still there is a problem with it..here only the "other" part is showing in the chart.rest
of the sectors are not showing..