Splunk Search

How to generate pie chart for internal app usage?

kpavan
Path Finder

Hi All,

I have logs from my SSO servers, where I need to show a few apps' usage with names and rest all other apps display as otherapps.
I tried below but the results are not accurate. And I need to display in a pie chart with correct values.

index=sso sourcetype="mysource" status=success | stats count as otherapps count(eval(searchmatch("jira"))) as jira count(eval(searchmatch("service-now"))) as ServiceNow count(eval(searchmatch("exchange"))) as Exchange count(eval(searchmatch("office365"))) as office365 count(eval(searchmatch("bitbucket"))) as Bitbucket count(eval(searchmatch("Cost"))) as Cost | transpose

Please help me with correct search, thanks in advance!

Thanks!
Pavna

Labels (4)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Be aware that stats count as otherapps actually counts ALL events, not just those not counted by other stats.
To get "other" apps, you would have to subtract all counts from the total count. For example, | eval others = otherapps - ServiceNow - Exchange - office365 - Bitbucket - Cost.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Transforming Financial Data into Fraud Intelligence

Every day, banks and financial companies handle millions of transactions, logins, and customer interactions ...

How to send events & findings from AWS to Splunk using Amazon EventBridge

Amazon EventBridge is a serverless service that uses events to connect application components together, making ...

Exciting News: The AppDynamics Community Joins Splunk!

Hello Splunkers,   I’d like to introduce myself—I’m Ryan, the former AppDynamics Community Manager, and I’m ...