Splunk Search

How to include the country in the PIE chart

jaibalaraman
Path Finder

Hi 

Can anyone help me with below query 

I have created a pie chart based on the error message, however i am not sure how to add country along 

index=test
| iplocation Properties.ip
| dedup Properties.ip
| stats count by event.Properties.errMessage

jaibalaraman_0-1712097532525.png

jaibalaraman_1-1712097568683.png

 

 

 

 

Tags (1)
0 Karma

bowesmana
SplunkTrust
SplunkTrust

You will either have to show the pie chart as a trellis chart so it shows one chart for each country or create a composite field containing both country and error message, as the pie chart can only show one dimension, i.e.

index=test
| iplocation Properties.ip
| dedup Properties.ip
| eval composite=country.":".'event.Properties.errMessage'
| stats count by composite

 Then the composite will be Australia:OK and so on.

 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Create a composite field with the two labels concatenated and count by that

0 Karma

jaibalaraman
Path Finder

Create a composite field with the two labels concatenated and count by that

I am not sure how to create composite filed, could you please advice on this please

 

0 Karma
Get Updates on the Splunk Community!

.conf25 Community Recap

Hello Splunkers, And just like that, .conf25 is in the books! What an incredible few days — full of learning, ...

Splunk App Developers | .conf25 Recap & What’s Next

If you stopped by the Builder Bar at .conf25 this year, thank you! The retro tech beer garden vibes were ...

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...