How to generate pie chart for internal app usage?

[kpavan]

Hi All,

I have logs from my SSO servers, where I need to show a few apps' usage with names and rest all other apps display as otherapps.
I tried below but the results are not accurate. And I need to display in a pie chart with correct values.

index=sso sourcetype="mysource" status=success | stats count as otherapps count(eval(searchmatch("jira"))) as jira count(eval(searchmatch("service-now"))) as ServiceNow count(eval(searchmatch("exchange"))) as Exchange count(eval(searchmatch("office365"))) as office365 count(eval(searchmatch("bitbucket"))) as Bitbucket count(eval(searchmatch("Cost"))) as Cost | transpose

Please help me with correct search, thanks in advance!

Thanks!
Pavna

[richgalloway]

Be aware that stats count as otherapps actually counts ALL events, not just those not counted by other stats.
To get "other" apps, you would have to subtract all counts from the total count. For example, | eval others = otherapps - ServiceNow - Exchange - office365 - Bitbucket - Cost.