Splunk Search

How to generate pie chart for internal app usage?

kpavan
Path Finder

Hi All,

I have logs from my SSO servers, where I need to show a few apps' usage with names and rest all other apps display as otherapps.
I tried below but the results are not accurate. And I need to display in a pie chart with correct values.

index=sso sourcetype="mysource" status=success | stats count as otherapps count(eval(searchmatch("jira"))) as jira count(eval(searchmatch("service-now"))) as ServiceNow count(eval(searchmatch("exchange"))) as Exchange count(eval(searchmatch("office365"))) as office365 count(eval(searchmatch("bitbucket"))) as Bitbucket count(eval(searchmatch("Cost"))) as Cost | transpose

Please help me with correct search, thanks in advance!

Thanks!
Pavna

Labels (4)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Be aware that stats count as otherapps actually counts ALL events, not just those not counted by other stats.
To get "other" apps, you would have to subtract all counts from the total count. For example, | eval others = otherapps - ServiceNow - Exchange - office365 - Bitbucket - Cost.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...