Splunk Enterprise

Display multiple values in multiple pie charts in trellis mode?

V21MGharib
Explorer

I would like to display multiple values in multiple pie charts.

For example: I want to display (Consumption & Remaining_Utilization) for each PowerStation in trellis mode

Using the following (partial) query

index="mtx" source="*Dual_Station*" MTX="*" PowerStation="*"
| eval Remaining_Utilization = Capacity - Consumption
| stats values(Remaining_Utilization) as Remaining_Utilization , values(Consumption) as Consumption by PowerStation

(What is missing after (stats)?
I checked each an every thread related to Pie charts in trellis mode in the community and couldn't find any answer

 

Hint: I use the following query to draw a single pie chart

index="mtx" source="*Dual_Station*" MTX="MTX_Name" PowerStation="PowerStation_Name"
| eval Remaining_Utilization = Capacity - Consumption
| chart values(Consumption) as Consumption over Remaining_Utilization
| transpose

 

 

Labels (1)
0 Karma
1 Solution

bowesmana
SplunkTrust
SplunkTrust

Use this ending to the search

| stats values(Remaining_Utilization) as Remaining_Utilization , values(Consumption) as Consumption by PowerStation
| transpose 0 header_field=PowerStation column_name="Energy"
| stats values(*) AS * by Energy

I am not totally use why the final stats line makes it work, but it shows an extra trellis aggregation, but does not change the data format, i.e. there is a single trellis option without the stats, but two with that final stats.

View solution in original post

0 Karma

bowesmana
SplunkTrust
SplunkTrust

Use this ending to the search

| stats values(Remaining_Utilization) as Remaining_Utilization , values(Consumption) as Consumption by PowerStation
| transpose 0 header_field=PowerStation column_name="Energy"
| stats values(*) AS * by Energy

I am not totally use why the final stats line makes it work, but it shows an extra trellis aggregation, but does not change the data format, i.e. there is a single trellis option without the stats, but two with that final stats.

0 Karma

V21MGharib
Explorer

This works like magic, thank you! But, I still can't figure out what does this mean?

Tags (1)
0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...

Updated Data Type Articles, Anniversary Celebrations, and More on Splunk Lantern

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

A Prelude to .conf25: Your Guide to Splunk University

Heading to Boston this September for .conf25? Get a jumpstart by arriving a few days early for Splunk ...