Splunk Search

How to create a chart from a search finding percentages?

brywilk_umich
Path Finder

I know Im likely missing something easy, but I cant seem to get the output how I would like. I have the below search that works great to find the percentage available but I would like to make this into a pie chart with Available and Unavailable numbers

index=nagios tag::src_host=collaboration (perfdata="HOSTPERFDATA" hoststate) OR (name="check_smtp" perfdata="SERVICEPERFDATA") | eval availabilityStatus=if(hoststate="DOWN" OR severity="CRITICAL","Unavailable","Available") | stats count(eval(availabilityStatus="Unavailable")) as unavailCount, count(eval(availabilityStatus="Available")) as availCount, count as totalCount | eval percentAvailable=(availCount/totalCount)*100

thanks all

0 Karma
1 Solution

somesoni2
Revered Legend

Try this

index=nagios tag::src_host=collaboration (perfdata="HOSTPERFDATA" hoststate) OR (name="check_smtp" perfdata="SERVICEPERFDATA") | eval availabilityStatus=if(hoststate="DOWN" OR severity="CRITICAL","Unavailable","Available") | stats count by availabilityStatus

This should give a pie chart with count of 'Available' and 'Unavailable' counts (with percent on tooltip,calculated automatically.

View solution in original post

somesoni2
Revered Legend

Try this

index=nagios tag::src_host=collaboration (perfdata="HOSTPERFDATA" hoststate) OR (name="check_smtp" perfdata="SERVICEPERFDATA") | eval availabilityStatus=if(hoststate="DOWN" OR severity="CRITICAL","Unavailable","Available") | stats count by availabilityStatus

This should give a pie chart with count of 'Available' and 'Unavailable' counts (with percent on tooltip,calculated automatically.

Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

May 2026 Splunk Expert Sessions: Security & Observability

Level Up Your Operations: May 2026 Splunk Expert Sessions Whether you are refining your security posture or ...

Network to App: Observability Unlocked [May & June Series]

In today’s digital landscape, your environment is no longer confined to the data center. It spans complex ...

SPL2 Deep Dives, AppDynamics Integrations, SAML Made Simple and Much More on Splunk ...

Splunk Lantern is Splunk’s customer success center that provides practical guidance from Splunk experts on key ...