Splunk Search

How to generate pie chart for internal app usage?

Path Finder

Hi All,

I have logs from my SSO servers, where I need to show a few apps' usage with names and rest all other apps display as otherapps.
I tried below but the results are not accurate. And I need to display in a pie chart with correct values.

index=sso sourcetype="mysource" status=success | stats count as otherapps count(eval(searchmatch("jira"))) as jira count(eval(searchmatch("service-now"))) as ServiceNow count(eval(searchmatch("exchange"))) as Exchange count(eval(searchmatch("office365"))) as office365 count(eval(searchmatch("bitbucket"))) as Bitbucket count(eval(searchmatch("Cost"))) as Cost | transpose

Please help me with correct search, thanks in advance!


Labels (4)
0 Karma


Be aware that stats count as otherapps actually counts ALL events, not just those not counted by other stats.
To get "other" apps, you would have to subtract all counts from the total count. For example, | eval others = otherapps - ServiceNow - Exchange - office365 - Bitbucket - Cost.

If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...