How do I get the right pie chart based on a group count?

[malderhout]

If have the following search in Splunk:

sourcetype = Tweets | stats count(eval(match(text, "string1"))) AS "string1" count(eval(match(text, "string2"))) AS "string2"

In the statistics tab, I get indeed 2 columns: string1 and string2 with the number of the matches of each.

Now I want to show it in a pie chart, but I get a full color (100%) of only string1.

How do I get a good pie chart, that divides the number of string 1 over (the total number of string1 and string2)?

[Richfez · Accepted solution]

You could try creating a new field that is precisely what you want, then chart that.

sourcetype = Tweets | stats count(eval(match(text, "string1"))) AS "string1" count(eval(match(text, "string2"))) AS "string2"
| eval Result=string1/(string1+string2) 

Then use Result as the field to chart.

[malderhout]

Hi and thx for the answer.

The new field is added in statistics, but if press the visualisation tab it still shows a 100% fill of string1

[Richfez]

Yes, I should have noticed that before. A Pie chart requires a specific type of input data. You can scroll down the Pie chart section of the Visualization Requirements documentation to see this. Or take my word for it, your choice. Your current data as you are doing it gets you values in multiple fields, like

Field1  Field2   Result
54        99          .4593

(I made up the numbers, they're not mathematically correct)

What you need it to look like is something more like

Field1    99
Field2    43

And, you don't really need the "Results" as we made them - or if you do, not necessarily for the same reason of making a pie chart with mouse-over statistics.

So how do we convert it to the right "looking" data?

sourcetype = Tweets | eval TweetMatches=case(match(_raw,"string1"), "string1", match(_raw, "string2"), "string2",1==1, "Other") | chart count by TweetMatches

I might have typoed something in there in my conversion from my own internal working sample to an example with your names, but otherwise that should create something close to what you want. Notice I included an "Other" field, you can drop off the entire end of that 1==1, "Other" if you don't want that, but I thought I would include that.

Then just check your Pie chart visualization and see what you think!

[malderhout]

Many Thanks I have the piechart working now!. Indeed I miss some knowledge regarding the visualisation possibilities with Splunk 🙂