Splunk Search

Create pie Chart from stats command

etherdoggy
Loves-to-Learn

I am trying to create a pie chart of success vs. failure with stats command with the following:

search | stats c(assigned_user) AS Success c(authorization_failure_user) AS Failed

Labels (1)
0 Karma

isoutamo
SplunkTrust
SplunkTrust
Hi
Are you trying to count those events or sum or what you are trying?
If count then change c -> count or dc on your stat.
r. Ismo
0 Karma

etherdoggy
Loves-to-Learn

Thanks for your response: 

I am using c count since each user may have multiple success or failure events. When I choose "Visualization", "pie", the pie renders as one metric. However, below the pie, I can see the numbers for both events are correct. Somehow the pie does not reflect the numbers.  

0 Karma
Get Updates on the Splunk Community!

OpenTelemetry for Legacy Apps? Yes, You Can!

This article is a follow-up to my previous article posted on the OpenTelemetry Blog, "Your Critical Legacy App ...

UCC Framework: Discover Developer Toolkit for Building Technology Add-ons

The Next-Gen Toolkit for Splunk Technology Add-on Development The Universal Configuration Console (UCC) ...

.conf25 Community Recap

Hello Splunkers, And just like that, .conf25 is in the books! What an incredible few days — full of learning, ...