Splunk Search

How to generate pie chart for internal app usage?

Path Finder

Hi All,

I have logs from my SSO servers, where I need to show a few apps' usage with names and rest all other apps display as otherapps.
I tried below but the results are not accurate. And I need to display in a pie chart with correct values.

index=sso sourcetype="mysource" status=success | stats count as otherapps count(eval(searchmatch("jira"))) as jira count(eval(searchmatch("service-now"))) as ServiceNow count(eval(searchmatch("exchange"))) as Exchange count(eval(searchmatch("office365"))) as office365 count(eval(searchmatch("bitbucket"))) as Bitbucket count(eval(searchmatch("Cost"))) as Cost | transpose

Please help me with correct search, thanks in advance!


Labels (4)
0 Karma


Be aware that stats count as otherapps actually counts ALL events, not just those not counted by other stats.
To get "other" apps, you would have to subtract all counts from the total count. For example, | eval others = otherapps - ServiceNow - Exchange - office365 - Bitbucket - Cost.

If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Observability | How to Think About Instrumentation Overhead (White Paper)

Novice observability practitioners are often overly obsessed with performance. They might approach ...

Cloud Platform | Get Resiliency in the Cloud Event (Register Now!)

IDC Report: Enterprises Gain Higher Efficiency and Resiliency With Migration to Cloud  Today many enterprises ...

The Great Resilience Quest: 10th Leaderboard Update

The tenth leaderboard update (11.23-12.05) for The Great Resilience Quest is out >> As our brave ...