Splunk Search

How to create a Pie Chart of particular events as percentage of all events?

ForeverNoob2
Engager

Hi. I am new to Splunk. I want to create a Pie Chart that consists of a particular type of event as a percentage of all events.

For example, all events that contain the word Linux, i would like to represent as a percentage of total events.

What would the search query be for this?

Thank you.

Labels (2)
Tags (1)
0 Karma
1 Solution

tscroggins
Builder

@ForeverNoob2 

Pie charts only require two fields: a category and a count.

E.g.:

*
| eval os=if(like(_raw, "%Linux%"), "Linux", "Other")
| stats count by os

View solution in original post

tscroggins
Builder

@ForeverNoob2 

Pie charts only require two fields: a category and a count.

E.g.:

*
| eval os=if(like(_raw, "%Linux%"), "Linux", "Other")
| stats count by os

View solution in original post

ForeverNoob2
Engager

Super. Thank you.