Splunk Search

How do I get a Sparkline to display as a pie chart?

adam_reber
Path Finder

I am attempting to use the sparkline functionality to display a pie chart in a table. My data has an asset_type ( workstation|server|router|appliance|printer|etc) and a status ( up|down|unknown). There are a large number of asset types, and they are subject to change/increase in number, so I don't just want to have a different panel for each type. I'd like to show a table with the asset type and a pie chart showing the up|down|unknown ratio. I can't seem to get the sparkline to only show the counts for the 3 distinct values of status, it seems to want to show those values 'over time' so my pie chart ends up with 8+ pieces, rather than 3. As pie is a supported option for a sparkline, and using time in a pie chart doesn't make any sense... I assume I'm missing something. I was trying the following:

<search> | chart sparkline(count(status)) AS trend by asset_type

XML Options:

<format field="trend" type="sparkline">
   <option name="type">pie</option>
 </format>
0 Karma
1 Solution

niketn
Legend

@Adam.reber, as discussed, you can refer to my Splunk Wiki Talk topic for jQuery Sparklines in Splunk or my Splunk answer for displaying pie chart.
http://wiki.splunk.com/User_talk:Niketnilay#Topic_11:_Types_of_jQuery_Sparklines_in_Splunk_.28beside...

https://answers.splunk.com/answers/474127/pie-chart-sparkline-to-see-filling-ratio-of-splunk.html

The jQuery sparklines implementation in Splunk seem to be hardcoded for _time and _span. So pie slices are based on span and can not be changed. Since Splunk officially does not support additional sparklines like pie, boxplot or tristate etc. it would not be possible to change span to something else.

Option 1: Tweak query to prepare results for jQuery tristate sparkline
However, if you can form your Splunk query in a way that your status is a value like up=1, down=-1 and unknown=0 for each time bucket (span) (possibly using streamstats), then you can use TRISTATE sparkline.

Option 2: Use pie charts with Trellis layout to plot all host with respective status
As discussed check out Trellis Layout where you can show pie chart for count of status as up, down and unknown and split to separate panels using your asset_type.

PS: I am attaching a run-anywhere dashboard example which uses Splunk's _internal index to plot Splunk component status(log_level) as INFO(green), WARN(yellow) or ERROR(red). You can use your own query with asset_type instead of component and status as up, unknown and down instead of INFO, WARN and ERROR.

alt text

<dashboard>
  <label>Trellis Pie</label>
  <row>
    <panel>
      <chart>
        <search>
          <query>index="_internal" sourcetype="splunkd" log_level="*" 
| stats count by log_level component
| head 20 </query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
        <option name="height">540</option>
        <option name="charting.fieldColors">{"INFO":#65a637,"ERROR":#f7bc38,"WARN":#d93f3c}</option>
        <option name="charting.axisTitleX.visibility">collapsed</option>
        <option name="charting.axisTitleY.visibility">collapsed</option>
        <option name="charting.axisTitleY2.visibility">collapsed</option>
        <option name="charting.chart">pie</option>
        <option name="charting.drilldown">none</option>
        <option name="charting.legend.placement">none</option>
        <option name="trellis.enabled">1</option>
        <option name="trellis.size">small</option>
        <option name="trellis.splitBy">component</option>
      </chart>
    </panel>
  </row>
</dashboard>
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

niketn
Legend

@Adam.reber, as discussed, you can refer to my Splunk Wiki Talk topic for jQuery Sparklines in Splunk or my Splunk answer for displaying pie chart.
http://wiki.splunk.com/User_talk:Niketnilay#Topic_11:_Types_of_jQuery_Sparklines_in_Splunk_.28beside...

https://answers.splunk.com/answers/474127/pie-chart-sparkline-to-see-filling-ratio-of-splunk.html

The jQuery sparklines implementation in Splunk seem to be hardcoded for _time and _span. So pie slices are based on span and can not be changed. Since Splunk officially does not support additional sparklines like pie, boxplot or tristate etc. it would not be possible to change span to something else.

Option 1: Tweak query to prepare results for jQuery tristate sparkline
However, if you can form your Splunk query in a way that your status is a value like up=1, down=-1 and unknown=0 for each time bucket (span) (possibly using streamstats), then you can use TRISTATE sparkline.

Option 2: Use pie charts with Trellis layout to plot all host with respective status
As discussed check out Trellis Layout where you can show pie chart for count of status as up, down and unknown and split to separate panels using your asset_type.

PS: I am attaching a run-anywhere dashboard example which uses Splunk's _internal index to plot Splunk component status(log_level) as INFO(green), WARN(yellow) or ERROR(red). You can use your own query with asset_type instead of component and status as up, unknown and down instead of INFO, WARN and ERROR.

alt text

<dashboard>
  <label>Trellis Pie</label>
  <row>
    <panel>
      <chart>
        <search>
          <query>index="_internal" sourcetype="splunkd" log_level="*" 
| stats count by log_level component
| head 20 </query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
        <option name="height">540</option>
        <option name="charting.fieldColors">{"INFO":#65a637,"ERROR":#f7bc38,"WARN":#d93f3c}</option>
        <option name="charting.axisTitleX.visibility">collapsed</option>
        <option name="charting.axisTitleY.visibility">collapsed</option>
        <option name="charting.axisTitleY2.visibility">collapsed</option>
        <option name="charting.chart">pie</option>
        <option name="charting.drilldown">none</option>
        <option name="charting.legend.placement">none</option>
        <option name="trellis.enabled">1</option>
        <option name="trellis.size">small</option>
        <option name="trellis.splitBy">component</option>
      </chart>
    </panel>
  </row>
</dashboard>
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

jkat54
SplunkTrust
SplunkTrust

Try changing your search to this:

| chart sparkline(count(status),1h) AS trend by asset_type

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...