Splunk Search

How to include the country in the PIE chart

jaibalaraman
Path Finder

Hi 

Can anyone help me with below query 

I have created a pie chart based on the error message, however i am not sure how to add country along 

index=test
| iplocation Properties.ip
| dedup Properties.ip
| stats count by event.Properties.errMessage

jaibalaraman_0-1712097532525.png

jaibalaraman_1-1712097568683.png

 

 

 

 

Tags (1)
0 Karma

bowesmana
SplunkTrust
SplunkTrust

You will either have to show the pie chart as a trellis chart so it shows one chart for each country or create a composite field containing both country and error message, as the pie chart can only show one dimension, i.e.

index=test
| iplocation Properties.ip
| dedup Properties.ip
| eval composite=country.":".'event.Properties.errMessage'
| stats count by composite

 Then the composite will be Australia:OK and so on.

 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Create a composite field with the two labels concatenated and count by that

0 Karma

jaibalaraman
Path Finder

Create a composite field with the two labels concatenated and count by that

I am not sure how to create composite filed, could you please advice on this please

 

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

What Is Splunk? Here’s What You Can Do with Splunk

Hey Splunk Community, we know you know Splunk. You likely leverage its unparalleled ability to ingest, index, ...

Level Up Your .conf25: Splunk Arcade Comes to Boston

With .conf25 right around the corner in Boston, there’s a lot to look forward to — inspiring keynotes, ...

Manual Instrumentation with Splunk Observability Cloud: How to Instrument Frontend ...

Although it might seem daunting, as we’ve seen in this series, manual instrumentation can be straightforward ...