How do I get a Sparkline to display as a pie chart?

[adam_reber]

I am attempting to use the sparkline functionality to display a pie chart in a table. My data has an asset_type ( workstation|server|router|appliance|printer|etc) and a status ( up|down|unknown). There are a large number of asset types, and they are subject to change/increase in number, so I don't just want to have a different panel for each type. I'd like to show a table with the asset type and a pie chart showing the up|down|unknown ratio. I can't seem to get the sparkline to only show the counts for the 3 distinct values of status, it seems to want to show those values 'over time' so my pie chart ends up with 8+ pieces, rather than 3. As pie is a supported option for a sparkline, and using time in a pie chart doesn't make any sense... I assume I'm missing something. I was trying the following:

<search> | chart sparkline(count(status)) AS trend by asset_type

XML Options:

<format field="trend" type="sparkline">
   <option name="type">pie</option>
 </format>

[niketn · Accepted solution]

@Adam.reber, as discussed, you can refer to my Splunk Wiki Talk topic for jQuery Sparklines in Splunk or my Splunk answer for displaying pie chart.
http://wiki.splunk.com/User_talk:Niketnilay#Topic_11:_Types_of_jQuery_Sparklines_in_Splunk_.28beside...

https://answers.splunk.com/answers/474127/pie-chart-sparkline-to-see-filling-ratio-of-splunk.html

The jQuery sparklines implementation in Splunk seem to be hardcoded for _time and _span. So pie slices are based on span and can not be changed. Since Splunk officially does not support additional sparklines like pie, boxplot or tristate etc. it would not be possible to change span to something else.

Option 1: Tweak query to prepare results for jQuery tristate sparkline
However, if you can form your Splunk query in a way that your status is a value like up=1, down=-1 and unknown=0 for each time bucket (span) (possibly using streamstats), then you can use TRISTATE sparkline.

Option 2: Use pie charts with Trellis layout to plot all host with respective status
As discussed check out Trellis Layout where you can show pie chart for count of status as up, down and unknown and split to separate panels using your asset_type.

PS: I am attaching a run-anywhere dashboard example which uses Splunk's _internal index to plot Splunk component status(log_level) as INFO(green), WARN(yellow) or ERROR(red). You can use your own query with asset_type instead of component and status as up, unknown and down instead of INFO, WARN and ERROR.

<dashboard>
  <label>Trellis Pie</label>
  <row>
    <panel>
      <chart>
        <search>
          <query>index="_internal" sourcetype="splunkd" log_level="*" 
| stats count by log_level component
| head 20 </query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
        <option name="height">540</option>
        <option name="charting.fieldColors">{"INFO":#65a637,"ERROR":#f7bc38,"WARN":#d93f3c}</option>
        <option name="charting.axisTitleX.visibility">collapsed</option>
        <option name="charting.axisTitleY.visibility">collapsed</option>
        <option name="charting.axisTitleY2.visibility">collapsed</option>
        <option name="charting.chart">pie</option>
        <option name="charting.drilldown">none</option>
        <option name="charting.legend.placement">none</option>
        <option name="trellis.enabled">1</option>
        <option name="trellis.size">small</option>
        <option name="trellis.splitBy">component</option>
      </chart>
    </panel>
  </row>
</dashboard>

[jkat54]

Try changing your search to this:

| chart sparkline(count(status),1h) AS trend by asset_type