Splunk Search

How to create a chart from a search finding percentages?

brywilk_umich
Path Finder

I know Im likely missing something easy, but I cant seem to get the output how I would like. I have the below search that works great to find the percentage available but I would like to make this into a pie chart with Available and Unavailable numbers

index=nagios tag::src_host=collaboration (perfdata="HOSTPERFDATA" hoststate) OR (name="check_smtp" perfdata="SERVICEPERFDATA") | eval availabilityStatus=if(hoststate="DOWN" OR severity="CRITICAL","Unavailable","Available") | stats count(eval(availabilityStatus="Unavailable")) as unavailCount, count(eval(availabilityStatus="Available")) as availCount, count as totalCount | eval percentAvailable=(availCount/totalCount)*100

thanks all

0 Karma
1 Solution

somesoni2
Revered Legend

Try this

index=nagios tag::src_host=collaboration (perfdata="HOSTPERFDATA" hoststate) OR (name="check_smtp" perfdata="SERVICEPERFDATA") | eval availabilityStatus=if(hoststate="DOWN" OR severity="CRITICAL","Unavailable","Available") | stats count by availabilityStatus

This should give a pie chart with count of 'Available' and 'Unavailable' counts (with percent on tooltip,calculated automatically.

View solution in original post

somesoni2
Revered Legend

Try this

index=nagios tag::src_host=collaboration (perfdata="HOSTPERFDATA" hoststate) OR (name="check_smtp" perfdata="SERVICEPERFDATA") | eval availabilityStatus=if(hoststate="DOWN" OR severity="CRITICAL","Unavailable","Available") | stats count by availabilityStatus

This should give a pie chart with count of 'Available' and 'Unavailable' counts (with percent on tooltip,calculated automatically.

Get Updates on the Splunk Community!

Automatic Discovery Part 1: What is Automatic Discovery in Splunk Observability Cloud ...

If you’ve ever deployed a new database cluster, spun up a caching layer, or added a load balancer, you know it ...

Real-Time Fraud Detection: How Splunk Dashboards Protect Financial Institutions

Financial fraud isn't slowing down. If anything, it's getting more sophisticated. Account takeovers, credit ...

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...