Splunk Search

How to create pie chart for two fields?

Dharani
Path Finder

Hi,

 

I have service name verb, object and outcome. I need to show the statistics in pie chart. 

For example,

index=abc (SUBJECT="Access"  AND OBJECT="status" AND VERB="Get") OR (SUBJECT="Customer Service" AND VERB=Get AND OBJECT="Customer status") OR (SUBJECT="Agreement service" AND OBJECT="attachments" AND VERB="Create") 
| search OUTCOME=FAILURE
| chart count by VERB,OBJECT

 

Results:

VERB                     Customer status              attachments

Get                                  3                                            0

Create                            0                                             2

 

What I am looking for is to show that 2 failures for create attachments and 3 failures for get customer status in Pie Chart format. But above query is not working like that , it is only showing one field in the pie chart which is not use ful.

 

Please help on this.

Thanks in Advance.

Labels (4)
0 Karma

yuanliu
SplunkTrust
SplunkTrust

By definition, pie chart visualizes a one-dimensional function.  When you use two fields in groupby, that creates a two-dimensional function.  Drop OBJECT.

index=abc (SUBJECT="Access"  AND OBJECT="status" AND VERB="Get") OR (SUBJECT="Customer Service" AND VERB=Get AND OBJECT="Customer status") OR (SUBJECT="Agreement service" AND OBJECT="attachments" AND VERB="Create") 
| search OUTCOME=FAILURE
| chart count by VERB

The caveat is that you must have positive knowledge that OBJECT and VERB are diagonal as your illustrated data show.  Otherwise you need to assess whether the results still suite your need.

Hope this helps.

0 Karma

Dharani
Path Finder

Hi,

Thanks for this , but only having VERB in pie chart will not help for my case.

Is there any possibility to join VERB and OBJECT to a single field and make that field in chart command.

 

Example,

VERB=get OBJECT=customer status

new_field="get customer status"

IN query:

chart count by new_field.

Please let me know if this is possible.

Thanks!

0 Karma

yuanliu
SplunkTrust
SplunkTrust

Yes, string concatenation can be used to flatten a vector when data are not strictly diagonal.

index=abc (SUBJECT="Access"  AND OBJECT="status" AND VERB="Get") OR (SUBJECT="Customer Service" AND VERB=Get AND OBJECT="Customer status") OR (SUBJECT="Agreement service" AND OBJECT="attachments" AND VERB="Create") 
| search OUTCOME=FAILURE
| eval verb_object = VERB . " " . OBJECT
| chart count by verb_object

Dharani
Path Finder

Thanks it works

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...