Add values of field and create pie

[LauraBre]

Hello,

I want to create a chart of pie type. I define a field named "Nb_PAN". The values of this field are integers. With this field, I want to create a pie. In this chart, I want to have a part with the sum of the values of the field Nb_PAN which are upper than 1 and a part with the sum of the values of the field Nb_PAN which are equal at 1. But, actually, my search add the number of events where the condition is true and not the sum of the values of the field Nb_PAN with the true condition.

This is my search:
tag::source="TokenizerWatchdogSplunk"| stats sum(eval(Nb_PAN<2)) AS NB_PAN_UNITAIRE, sum(eval(Nb_PAN>1)) AS NB_PAN_MASSSE

My second problem is that I can't do my tie because I don't know how create my chart.

Thanks for your answer.

[Ayn]

If you single out just the events where Nb_PAN is greater than 1 and create a new field with values from just those, you could handle it separately properly:

tag::source="TokenizerWatchdogSplunk"| eval nb_pan_greaterthanone=if(Nb_PAN>1,Nb_PAN,0) | stats count(eval(Nb_PAN=1)) AS NB_PAN_UNITAIRE, sum(nb_pan_greaterthanone) AS NB_PAN_MASSSE

[LauraBre]

Thanks for your answer. With your search, it's the good sum that it does. Now, I'm not able to create a pie with a part NB_PAN_UNITAIRE and a part NB_PAN_MASSSE. It takes only the Nb_PAN_UNITAIRE values. I think that it's because there are two columns in my table and to do a pie we have to do only one column no????

Thanks for your answer.