Splunk Search

How do I get a Sparkline to display as a pie chart?

Path Finder

I am attempting to use the sparkline functionality to display a pie chart in a table. My data has an asset_type ( workstation|server|router|appliance|printer|etc) and a status ( up|down|unknown). There are a large number of asset types, and they are subject to change/increase in number, so I don't just want to have a different panel for each type. I'd like to show a table with the asset type and a pie chart showing the up|down|unknown ratio. I can't seem to get the sparkline to only show the counts for the 3 distinct values of status, it seems to want to show those values 'over time' so my pie chart ends up with 8+ pieces, rather than 3. As pie is a supported option for a sparkline, and using time in a pie chart doesn't make any sense... I assume I'm missing something. I was trying the following:

<search> | chart sparkline(count(status)) AS trend by asset_type

XML Options:

<format field="trend" type="sparkline">
   <option name="type">pie</option>
0 Karma

Re: How do I get a Sparkline to display as a pie chart?


Try changing your search to this:

| chart sparkline(count(status),1h) AS trend by asset_type

0 Karma

Re: How do I get a Sparkline to display as a pie chart?


@adam.reber, as discussed, you can refer to my Splunk Wiki Talk topic for jQuery Sparklines in Splunk or my Splunk answer for displaying pie chart.


The jQuery sparklines implementation in Splunk seem to be hardcoded for _time and _span. So pie slices are based on span and can not be changed. Since Splunk officially does not support additional sparklines like pie, boxplot or tristate etc. it would not be possible to change span to something else.

Option 1: Tweak query to prepare results for jQuery tristate sparkline
However, if you can form your Splunk query in a way that your status is a value like up=1, down=-1 and unknown=0 for each time bucket (span) (possibly using streamstats), then you can use TRISTATE sparkline.

Option 2: Use pie charts with Trellis layout to plot all host with respective status
As discussed check out Trellis Layout where you can show pie chart for count of status as up, down and unknown and split to separate panels using your asset_type.

PS: I am attaching a run-anywhere dashboard example which uses Splunk's internal index to plot Splunk component `status(loglevel)as INFO(green), WARN(yellow) or ERROR(red). You can use your own query withasset_typeinstead of component and status asup, unknown and down` instead of INFO, WARN and ERROR.

alt text

  <label>Trellis Pie</label>
          <query>index="_internal" sourcetype="splunkd" log_level="*" 
| stats count by log_level component
| head 20 </query>
        <option name="height">540</option>
        <option name="charting.fieldColors">{"INFO":#65a637,"ERROR":#f7bc38,"WARN":#d93f3c}</option>
        <option name="charting.axisTitleX.visibility">collapsed</option>
        <option name="charting.axisTitleY.visibility">collapsed</option>
        <option name="charting.axisTitleY2.visibility">collapsed</option>
        <option name="charting.chart">pie</option>
        <option name="charting.drilldown">none</option>
        <option name="charting.legend.placement">none</option>
        <option name="trellis.enabled">1</option>
        <option name="trellis.size">small</option>
        <option name="trellis.splitBy">component</option>

View solution in original post

Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.