Splunk Search

Create pie Chart from stats command

etherdoggy
Loves-to-Learn

I am trying to create a pie chart of success vs. failure with stats command with the following:

search | stats c(assigned_user) AS Success c(authorization_failure_user) AS Failed

Labels (1)
0 Karma

isoutamo
SplunkTrust
SplunkTrust
Hi
Are you trying to count those events or sum or what you are trying?
If count then change c -> count or dc on your stat.
r. Ismo
0 Karma

etherdoggy
Loves-to-Learn

Thanks for your response: 

I am using c count since each user may have multiple success or failure events. When I choose "Visualization", "pie", the pie renders as one metric. However, below the pie, I can see the numbers for both events are correct. Somehow the pie does not reflect the numbers.  

0 Karma
Get Updates on the Splunk Community!

AppDynamics Summer Webinars

This summer, our mighty AppDynamics team is cooking up some delicious content on YouTube Live to satiate your ...

SOCin’ it to you at Splunk University

Splunk University is expanding its instructor-led learning portfolio with dedicated Security tracks at .conf25 ...

Credit Card Data Protection & PCI Compliance with Splunk Edge Processor

Organizations handling credit card transactions know that PCI DSS compliance is both critical and complex. The ...