Splunk Search

How to create a pie chart with only true false values

disillusioned
New Member

I am working with this search:

index=lab-testresults type=browser NOT(browser="UK*" OR browser="Firefox") suiteID="*"
| stats latest(success) as success by browser noxID 
| stats count(eval(success="true")) as PassCount
    count(eval(success="false")) as FailCount
    count as Total by browser
| fields browser, PassCount, FailCount, Total

but when I use the trellis on my visualization, the pie charts only show a single value like this:
alt text

The Question:
How do I get it so that each of my pie charts shows the correct slice of passes and failures according to the data and not just one field like it is now?

I am working with this search query:

index=lab-testresults type=browser NOT(browser="UK*" OR browser="Firefox") suiteID="*"
| stats latest(success) as success by browser noxID 
| stats count(eval(success="true")) as PassCount
    count(eval(success="false")) as FailCount
    count as Total by browser
| fields browser, PassCount, FailCount, Total

but every time I use trellis on a dashboard it shows this:

alt text

This only shows a whole pie chart, but we can see that both counts are there, and adding the Total that we define in the count above also doesn't change the problem.
I would like the pie chart to display the passes and the failures as two separate parts of the pie. Is there any way to do this?

(additional context: I am later going to add charting.fieldColors to this pie so that passes are green and failures are red, so any way to do show the two parts of the pie, with labels for passes and fails, and finally adding in the colors would be great!)

Thanks!

0 Karma

FrankVl
Ultra Champion

Try the chart command, instead of stats:

index=lab-testresults type=browser NOT(browser="UK*" OR browser="Firefox") suiteID="*"
| stats latest(success) as success by browser noxID
| chart count over browser by success
| rename true as PassCount
| rename false as FailCount
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi disillusioned,
which field do you used for the "Split by" option ?

<option name="trellis.splitBy">broser</option>

For more information see the Splunk Dashboard Examples App ( https://splunkbase.splunk.com/app/1603/ ).

Bye.
Giuseppe

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas

Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas     Cisco Live 2026 is almost here, and this ...

What Is the Name of the USB Key Inserted by Bob Smith? (BOTS Hint, Not the Answer)

Hello Splunkers,   So you searched, “what is the name of the usb key inserted by bob smith?”  Not gonna lie… ...

Automating Threat Operations and Threat Hunting with Recorded Future

    Automating Threat Operations and Threat Hunting with Recorded Future June 29, 2026 | Register   Is your ...