Splunk Search

How should I convert my bar chart to a meaningful pie chart?

athorat
Communicator

I have a search which returns transaction status for each resource.
Resource A: Transacation Status = Success

And
Transacation Status = Fail

Similarly for
Resource B :Transacation Status = Success

AND
Transacation Status = FAIL

The visualization does appear good in a Bar chart. How can I change it to a meaningful pie chart (Latency can be ignored)?

index="np_dpa" sourcetype="DP:SIT:SYSLOG" PROXYNAME="PASTelematicsAPI" | chart avg(Latency) as Avg_Response_Time count over Resource  by  TransactionStatus

Also, If I have to keep it as a bar chart, the Resource name which appears on the X-axis is aligned to left. Can this be aligned to center?

Tags (2)
0 Karma

mporath_splunk
Splunk Employee
Splunk Employee

First of all, I would recommend changing your search from using chart to stats. That formats the data in a way that's well suited for both bar and pie charts.

index="np_dpa" sourcetype="DP:SIT:SYSLOG" PROXYNAME="PASTelematicsAPI" | stats avg(Latency) as Avg_Response_Time count  by  TransactionStatus

Next, to decide whether to display a pie chart or a bar chart, it depends what you want to get out of the visualization.

  • I'm interested in how all transactions break down => Pie chart
  • I'm interested in how many transactions succeed/fail => Bar chart

As for the label formatting, unfortunately it's not possible to change the alignment of axis labels.

0 Karma
Get Updates on the Splunk Community!

Automatic Discovery Part 1: What is Automatic Discovery in Splunk Observability Cloud ...

If you’ve ever deployed a new database cluster, spun up a caching layer, or added a load balancer, you know it ...

Real-Time Fraud Detection: How Splunk Dashboards Protect Financial Institutions

Financial fraud isn't slowing down. If anything, it's getting more sophisticated. Account takeovers, credit ...

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...