Splunk Search

Create pie Chart from stats command

etherdoggy
Loves-to-Learn

I am trying to create a pie chart of success vs. failure with stats command with the following:

search | stats c(assigned_user) AS Success c(authorization_failure_user) AS Failed

Labels (1)
0 Karma

isoutamo
SplunkTrust
SplunkTrust
Hi
Are you trying to count those events or sum or what you are trying?
If count then change c -> count or dc on your stat.
r. Ismo
0 Karma

etherdoggy
Loves-to-Learn

Thanks for your response: 

I am using c count since each user may have multiple success or failure events. When I choose "Visualization", "pie", the pie renders as one metric. However, below the pie, I can see the numbers for both events are correct. Somehow the pie does not reflect the numbers.  

0 Karma
Get Updates on the Splunk Community!

Splunk Enterprise Security: Your Command Center for PCI DSS Compliance

Every security professional knows the drill. The PCI DSS audit is approaching, and suddenly everyone's asking ...

Developer Spotlight with Guilhem Marchand

From Splunk Engineer to Founder: The Journey Behind TrackMe    After spending over 12 years working full time ...

Cisco Catalyst Center Meets Splunk ITSI: From 'Payments Are Down' to Root Cause in ...

The Problem: When Networks and Services Don't Talk Payment systems fail at a retail location. Customers are ...