Splunk Search

How to create a pie chart with only true false values

disillusioned
New Member

I am working with this search:

index=lab-testresults type=browser NOT(browser="UK*" OR browser="Firefox") suiteID="*"
| stats latest(success) as success by browser noxID 
| stats count(eval(success="true")) as PassCount
    count(eval(success="false")) as FailCount
    count as Total by browser
| fields browser, PassCount, FailCount, Total

but when I use the trellis on my visualization, the pie charts only show a single value like this:
alt text

The Question:
How do I get it so that each of my pie charts shows the correct slice of passes and failures according to the data and not just one field like it is now?

I am working with this search query:

index=lab-testresults type=browser NOT(browser="UK*" OR browser="Firefox") suiteID="*"
| stats latest(success) as success by browser noxID 
| stats count(eval(success="true")) as PassCount
    count(eval(success="false")) as FailCount
    count as Total by browser
| fields browser, PassCount, FailCount, Total

but every time I use trellis on a dashboard it shows this:

alt text

This only shows a whole pie chart, but we can see that both counts are there, and adding the Total that we define in the count above also doesn't change the problem.
I would like the pie chart to display the passes and the failures as two separate parts of the pie. Is there any way to do this?

(additional context: I am later going to add charting.fieldColors to this pie so that passes are green and failures are red, so any way to do show the two parts of the pie, with labels for passes and fails, and finally adding in the colors would be great!)

Thanks!

0 Karma

FrankVl
Ultra Champion

Try the chart command, instead of stats:

index=lab-testresults type=browser NOT(browser="UK*" OR browser="Firefox") suiteID="*"
| stats latest(success) as success by browser noxID
| chart count over browser by success
| rename true as PassCount
| rename false as FailCount
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi disillusioned,
which field do you used for the "Split by" option ?

<option name="trellis.splitBy">broser</option>

For more information see the Splunk Dashboard Examples App ( https://splunkbase.splunk.com/app/1603/ ).

Bye.
Giuseppe

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Index This | What travels the world but is also stuck in place?

April 2026 Edition  Hayyy Splunk Education Enthusiasts and the Eternally Curious!   We’re back with this ...

Discover New Use Cases: Unlock Greater Value from Your Existing Splunk Data

Realizing the full potential of your Splunk investment requires more than just understanding current usage; it ...

Continue Your Journey: Join Session 2 of the Data Management and Federation Bootcamp ...

As data volumes continue to grow and environments become more distributed, managing and optimizing data ...