Splunk Search

How should I convert my bar chart to a meaningful pie chart?

athorat
Communicator

I have a search which returns transaction status for each resource.
Resource A: Transacation Status = Success

And
Transacation Status = Fail

Similarly for
Resource B :Transacation Status = Success

AND
Transacation Status = FAIL

The visualization does appear good in a Bar chart. How can I change it to a meaningful pie chart (Latency can be ignored)?

index="np_dpa" sourcetype="DP:SIT:SYSLOG" PROXYNAME="PASTelematicsAPI" | chart avg(Latency) as Avg_Response_Time count over Resource  by  TransactionStatus

Also, If I have to keep it as a bar chart, the Resource name which appears on the X-axis is aligned to left. Can this be aligned to center?

Tags (2)
0 Karma

mporath_splunk
Splunk Employee
Splunk Employee

First of all, I would recommend changing your search from using chart to stats. That formats the data in a way that's well suited for both bar and pie charts.

index="np_dpa" sourcetype="DP:SIT:SYSLOG" PROXYNAME="PASTelematicsAPI" | stats avg(Latency) as Avg_Response_Time count  by  TransactionStatus

Next, to decide whether to display a pie chart or a bar chart, it depends what you want to get out of the visualization.

  • I'm interested in how all transactions break down => Pie chart
  • I'm interested in how many transactions succeed/fail => Bar chart

As for the label formatting, unfortunately it's not possible to change the alignment of axis labels.

0 Karma
Get Updates on the Splunk Community!

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...