PDF reports, how to designate the chart type?

[rwiebke]

We have a search that takes total logins and tallys the OK logins, incorrect logins and invalid logins. From the report builder its default output is as columns but we can choose the pie chart type to get the output we're looking for. Unforfunately you cannot create a pdf from the report builder, but you can schedule the search and have it email you the pdf. The PDF in the subsequent email comes in as columns, not a pie chart.

How do you specify in the search that the output should be in the pie chart format? Thanks in advance.

[jarjoh42]

To alter the type of chart on the PDF you can find the search in the savedsearches.conf file. At the bottom of the search you will find a vsid=(some set of char). This is the view state ID. Open the viewstates.conf file in the same app and find the corresponding view. If it is a flashtimeline: (that VSID number) the second line down should be ChartTypeFormatter_0_14_0.default = (Chart Type). By changing this value to pie chart you should get the results you are looking for.

You can also use the GUI described in this link
http://docs.splunk.com/Documentation/Splunk/5.0.4/Viz/Savingreportsandsharingthemwithothers