Dashboards & Visualizations

problem with pie chart

prapanna
Explorer

hi
i hav read the docs of Splunk but still unable to solve my problem..i want to create a pie chart where there are 5 sector.4 of them are for different url(that will be chosen by me) and the other sector will consist of rest of the urls. and the name of this sector will be OTHER.. what will be the searching code?
thanx..

Tags (1)
0 Karma

prapanna
Explorer

thnx for the answer.. but still there is a problem with it..here only the "other" part is showing in the chart.rest

of the sectors are not showing..

0 Karma

asimagu
Builder

before charting you could do create a new field based on a eval, if it's one of the four url's it will have the url name , if that is not the case the value will be "other"

eval my_url=case(url==url1,"url1",url==url2,"url2",url==url3,"url3",url==url4,"url4",url!="url1" AND url!=url2 AND url!=url3 AND url!=url4,"other") | chart count by my_url
0 Karma

asimagu
Builder

did that one work?

0 Karma

asimagu
Builder

sorry, I just edited my answer, that should work now

0 Karma

prapanna
Explorer

thnx for the answer.. but still there is a problem with it..here only the "other" part is showing in the chart.rest

of the sectors are not showing..

0 Karma
Get Updates on the Splunk Community!

Platform Newsletter Highlights | March 2023

 March 2023 | Check out the latest and greatestIntroducing Splunk Edge Processor, simplified data ...

Enterprise Security Content Updates (ESCU) - New Releases

In the last month, the Splunk Threat Research Team (STRT) has had 3 releases of new content via the Enterprise ...

Thought Leaders are Validating Your Hard Work and Training Rigor

As a Splunk enthusiast and member of the Splunk Community, you are one of thousands who recognize the value of ...