Splunk Search

How can we edit our search to visualize results on a pie chart?

splunker9999
Path Finder

Hi,

We have the search below and are looking to view results in pie chart format. We are facing difficulties to visualize this with Pie chart. How do we edit our search to make this possible?

index=index sourcetype=hadoop: us.LogUtility | eval TotalTimeSolr = Solr_Personalized_Instore + Solr_Personalized_Online + Solr_NonPersonalized | eval TotalTimeHBase = Hbase_Card_Master + Hbase_Card_Upgrade_Info + Hbase_Cust_Info_Specialoffers + Hbase_Cust_Info_CMData + Hbase_Offer_Details + Hbase_Global_Offers_InfoEnrol + Hbase_Global_Offers_Info_Lob + Hbase_Cust_Info_Feedback + Hbase_Offer_Popular + Hbase_Offer_Random |where (TotalTime > 5000 OR TotalTimeSolr>5000 OR TotalTimeHBase>5000)
|eval TotalTime=if(TotalTime<5000,0,TotalTime)
|eval TotalTimeSolr=if(TotalTimeSolr<5000,0,TotalTimeSolr)
|eval TotalTimeHBase=if(TotalTimeHBase<5000,0,TotalTimeHBase)
|stats count(eval(TotalTime!=0)) as TotalTime count(eval(TotalTimeSolr!=0)) as SolrTime count(eval(TotalTimeHBase!=0)) as HBaseTime

Please advise or suggest if there is a way we can convert this.

0 Karma
1 Solution

somesoni2
SplunkTrust
SplunkTrust

Try this

 index=index sourcetype=hadoop: us.LogUtility | eval TotalTimeSolr = Solr_Personalized_Instore + Solr_Personalized_Online + Solr_NonPersonalized | eval TotalTimeHBase = Hbase_Card_Master + Hbase_Card_Upgrade_Info + Hbase_Cust_Info_Specialoffers + Hbase_Cust_Info_CMData + Hbase_Offer_Details + Hbase_Global_Offers_InfoEnrol + Hbase_Global_Offers_Info_Lob + Hbase_Cust_Info_Feedback + Hbase_Offer_Popular + Hbase_Offer_Random |where (TotalTime > 5000 OR TotalTimeSolr>5000 OR TotalTimeHBase>5000)
 |eval TotalTime=if(TotalTime<5000,0,TotalTime)
 |eval TotalTimeSolr=if(TotalTimeSolr<5000,0,TotalTimeSolr)
 |eval TotalTimeHBase=if(TotalTimeHBase<5000,0,TotalTimeHBase)
 |stats count(eval(TotalTime!=0)) as TotalTime count(eval(TotalTimeSolr!=0)) as SolrTime count(eval(TotalTimeHBase!=0)) as HBaseTime
 | eval temp=1 | untable temp Metrics Value | fields - temp

View solution in original post

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Try this

 index=index sourcetype=hadoop: us.LogUtility | eval TotalTimeSolr = Solr_Personalized_Instore + Solr_Personalized_Online + Solr_NonPersonalized | eval TotalTimeHBase = Hbase_Card_Master + Hbase_Card_Upgrade_Info + Hbase_Cust_Info_Specialoffers + Hbase_Cust_Info_CMData + Hbase_Offer_Details + Hbase_Global_Offers_InfoEnrol + Hbase_Global_Offers_Info_Lob + Hbase_Cust_Info_Feedback + Hbase_Offer_Popular + Hbase_Offer_Random |where (TotalTime > 5000 OR TotalTimeSolr>5000 OR TotalTimeHBase>5000)
 |eval TotalTime=if(TotalTime<5000,0,TotalTime)
 |eval TotalTimeSolr=if(TotalTimeSolr<5000,0,TotalTimeSolr)
 |eval TotalTimeHBase=if(TotalTimeHBase<5000,0,TotalTimeHBase)
 |stats count(eval(TotalTime!=0)) as TotalTime count(eval(TotalTimeSolr!=0)) as SolrTime count(eval(TotalTimeHBase!=0)) as HBaseTime
 | eval temp=1 | untable temp Metrics Value | fields - temp
0 Karma

splunker9999
Path Finder

Thanks, Works like a champ.

0 Karma

splunker9999
Path Finder

Hi, This is working ,but when ever 0 results found, I could see fields on Pie chart is visible(only with lines), can we some how hide those details.

I thought of hiding this panel when 0 results found by setting token $showpanel$,,but this panel is already depends on another panel , can we use 2 panel depends?

Thanks

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...