Splunk Search

Add values of field and create pie

LauraBre
Communicator

Hello,

I want to create a chart of pie type. I define a field named "Nb_PAN". The values of this field are integers. With this field, I want to create a pie. In this chart, I want to have a part with the sum of the values of the field Nb_PAN which are upper than 1 and a part with the sum of the values of the field Nb_PAN which are equal at 1. But, actually, my search add the number of events where the condition is true and not the sum of the values of the field Nb_PAN with the true condition.

This is my search:
tag::source="TokenizerWatchdogSplunk"| stats sum(eval(Nb_PAN<2)) AS NB_PAN_UNITAIRE, sum(eval(Nb_PAN>1)) AS NB_PAN_MASSSE

My second problem is that I can't do my tie because I don't know how create my chart.

Thanks for your answer.

Tags (2)
0 Karma

Ayn
Legend

If you single out just the events where Nb_PAN is greater than 1 and create a new field with values from just those, you could handle it separately properly:

tag::source="TokenizerWatchdogSplunk"| eval nb_pan_greaterthanone=if(Nb_PAN>1,Nb_PAN,0) | stats count(eval(Nb_PAN=1)) AS NB_PAN_UNITAIRE, sum(nb_pan_greaterthanone) AS NB_PAN_MASSSE
0 Karma

LauraBre
Communicator

Thanks for your answer. With your search, it's the good sum that it does. Now, I'm not able to create a pie with a part NB_PAN_UNITAIRE and a part NB_PAN_MASSSE. It takes only the Nb_PAN_UNITAIRE values. I think that it's because there are two columns in my table and to do a pie we have to do only one column no????

Thanks for your answer.

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...