Splunk Search
Highlighted

How can we edit our search to visualize results on a pie chart?

Path Finder

Hi,

We have the search below and are looking to view results in pie chart format. We are facing difficulties to visualize this with Pie chart. How do we edit our search to make this possible?

index=index sourcetype=hadoop: us.LogUtility | eval TotalTimeSolr = Solr_Personalized_Instore + Solr_Personalized_Online + Solr_NonPersonalized | eval TotalTimeHBase = Hbase_Card_Master + Hbase_Card_Upgrade_Info + Hbase_Cust_Info_Specialoffers + Hbase_Cust_Info_CMData + Hbase_Offer_Details + Hbase_Global_Offers_InfoEnrol + Hbase_Global_Offers_Info_Lob + Hbase_Cust_Info_Feedback + Hbase_Offer_Popular + Hbase_Offer_Random |where (TotalTime > 5000 OR TotalTimeSolr>5000 OR TotalTimeHBase>5000)
|eval TotalTime=if(TotalTime<5000,0,TotalTime)
|eval TotalTimeSolr=if(TotalTimeSolr<5000,0,TotalTimeSolr)
|eval TotalTimeHBase=if(TotalTimeHBase<5000,0,TotalTimeHBase)
|stats count(eval(TotalTime!=0)) as TotalTime count(eval(TotalTimeSolr!=0)) as SolrTime count(eval(TotalTimeHBase!=0)) as HBaseTime

Please advise or suggest if there is a way we can convert this.

0 Karma
Highlighted

Re: How can we edit our search to visualize results on a pie chart?

SplunkTrust
SplunkTrust

Try this

 index=index sourcetype=hadoop: us.LogUtility | eval TotalTimeSolr = Solr_Personalized_Instore + Solr_Personalized_Online + Solr_NonPersonalized | eval TotalTimeHBase = Hbase_Card_Master + Hbase_Card_Upgrade_Info + Hbase_Cust_Info_Specialoffers + Hbase_Cust_Info_CMData + Hbase_Offer_Details + Hbase_Global_Offers_InfoEnrol + Hbase_Global_Offers_Info_Lob + Hbase_Cust_Info_Feedback + Hbase_Offer_Popular + Hbase_Offer_Random |where (TotalTime > 5000 OR TotalTimeSolr>5000 OR TotalTimeHBase>5000)
 |eval TotalTime=if(TotalTime<5000,0,TotalTime)
 |eval TotalTimeSolr=if(TotalTimeSolr<5000,0,TotalTimeSolr)
 |eval TotalTimeHBase=if(TotalTimeHBase<5000,0,TotalTimeHBase)
 |stats count(eval(TotalTime!=0)) as TotalTime count(eval(TotalTimeSolr!=0)) as SolrTime count(eval(TotalTimeHBase!=0)) as HBaseTime
 | eval temp=1 | untable temp Metrics Value | fields - temp

View solution in original post

0 Karma
Highlighted

Re: How can we edit our search to visualize results on a pie chart?

Path Finder

Thanks, Works like a champ.

0 Karma
Highlighted

Re: How can we edit our search to visualize results on a pie chart?

Path Finder

Hi, This is working ,but when ever 0 results found, I could see fields on Pie chart is visible(only with lines), can we some how hide those details.

I thought of hiding this panel when 0 results found by setting token $showpanel$,,but this panel is already depends on another panel , can we use 2 panel depends?

Thanks

0 Karma