How to create pie chart for two fields?

[Dharani]

Hi,

I have service name verb, object and outcome. I need to show the statistics in pie chart. 

For example,

index=abc (SUBJECT="Access"  AND OBJECT="status" AND VERB="Get") OR (SUBJECT="Customer Service" AND VERB=Get AND OBJECT="Customer status") OR (SUBJECT="Agreement service" AND OBJECT="attachments" AND VERB="Create") 
| search OUTCOME=FAILURE
| chart count by VERB,OBJECT

Results:

VERB                     Customer status              attachments

Get                                  3                                            0

Create                            0                                             2

What I am looking for is to show that 2 failures for create attachments and 3 failures for get customer status in Pie Chart format. But above query is not working like that , it is only showing one field in the pie chart which is not use ful.

Please help on this.

Thanks in Advance.

[yuanliu]

By definition, pie chart visualizes a one-dimensional function.  When you use two fields in groupby, that creates a two-dimensional function.  Drop OBJECT.

index=abc (SUBJECT="Access"  AND OBJECT="status" AND VERB="Get") OR (SUBJECT="Customer Service" AND VERB=Get AND OBJECT="Customer status") OR (SUBJECT="Agreement service" AND OBJECT="attachments" AND VERB="Create") 
| search OUTCOME=FAILURE
| chart count by VERB

The caveat is that you must have positive knowledge that OBJECT and VERB are diagonal as your illustrated data show.  Otherwise you need to assess whether the results still suite your need.

Hope this helps.

[Dharani]

Hi,

Thanks for this , but only having VERB in pie chart will not help for my case.

Is there any possibility to join VERB and OBJECT to a single field and make that field in chart command.

Example,

VERB=get OBJECT=customer status

new_field="get customer status"

IN query:

chart count by new_field.

Please let me know if this is possible.

Thanks!

[yuanliu]

Yes, string concatenation can be used to flatten a vector when data are not strictly diagonal.

index=abc (SUBJECT="Access"  AND OBJECT="status" AND VERB="Get") OR (SUBJECT="Customer Service" AND VERB=Get AND OBJECT="Customer status") OR (SUBJECT="Agreement service" AND OBJECT="attachments" AND VERB="Create") 
| search OUTCOME=FAILURE
| eval verb_object = VERB . " " . OBJECT
| chart count by verb_object

[Dharani]

Thanks it works