Splunk Search

How to create a PIE chart for multiple subsearches?

vkumar6
Explorer

Hi

How can I create a PIE chart using multiple subsearches?

notable | search source="ENV: Windows Privilege Escalation" OR source="ENV:interactive login" OR source="Env:Concurrent Login Attempts Detected" | stats count as Win | appendcols [search notable | search source="ENV*virus" OR source=malware| stats count as AV] | appendcols [search notable | search source="env*intrusion" | stats count as Intrusion] | appendcols [search notable | search source="env*email" | stats count as Email] | appendcols [search notable | search source="env*vul" | stats count as Vuler]

Tags (2)
0 Karma

somesoni2
Revered Legend

Try this

`notable` | search source="*ENV: Windows Privilege Escalation*" OR source="*ENV:interactive login*" OR source="*Env:Concurrent Login Attempts Detected*"  | stats count | eval Type="Win" | append  [search `notable` | search source="*ENV*virus*" OR source=*malware*| stats count | eval Type="AV"] | append [search `notable` | search source="*env*intrusion*" | stats count | eval Type="Intrusion" ] | append [search `notable` | search source="*env*email*" | stats count | eval Type="Email" ] | append [search `notable` | search source="*env*vul*" | stats count | eval Type="Vuler"] 

OR Better...

`notable` 
| search (source="*ENV: Windows Privilege Escalation*" OR source="*ENV:interactive login*" OR source="*Env:Concurrent Login Attempts Detected*" ) OR (source="*ENV*virus*" OR source=*malware*) OR (source="*env*intrusion*") OR (source="*env*email*") OR (source="*env*vul*")
| eval Type=case((source="*ENV: Windows Privilege Escalation*" OR source="*ENV:interactive login*" OR source="*Env:Concurrent Login Attempts Detected*" ),"Win",(source="*ENV*virus*" OR source=*malware*),"AV", (source="*env*intrusion*"),"Intrusion", (source="*env*email*") ,"Email", (source="*env*vul*"),"Vulenr")
| stats count by Type
0 Karma
Get Updates on the Splunk Community!

Database Performance Sidebar Panel Now on APM Database Query Performance & Service ...

We’ve streamlined the troubleshooting experience for database-related service issues by adding a database ...

IM Landing Page Filter - Now Available

We’ve added the capability for you to filter across the summary details on the main Infrastructure Monitoring ...

Dynamic Links from Alerts to IM Navigators - New in Observability Cloud

Splunk continues to improve the troubleshooting experience in Observability Cloud with this latest enhancement ...