I have 4 columns with 1 data in each, I wrote this query with the help of AppendCols and populate my results, please check below for more details.

[krsuraj11]

I have 4 columns with 1 data in each, I wrote this query with the help of AppendCols and populate my results, now I want to produce a Pie Chart, but Pie Chart is not populating correctly and Only one data displaying in the Pie (which is the first column), please help populating my result in Pie chart with all the four column.

[vnravikumar]

Hi

Please post your query.

[niketn]

@krsuraj11 Also post some sample data. With your current query what is the output you are having? You may want append instead of appendcols (subsearch may not be required at all, however, community would be able to assist you better only if you provide your current query and sample data).

If you just want to be done with your use case, you can pipe a transpose command at the end of your current query and you should be able to see pie chart. Please try out and confirm (however, this may not be the most optimized way of writing SPL).

<yourCurrentSearch>
|  transpose

Following is a run anywhere example to transform columns to rows using transpose which ca:

|  makeresults
|  fields - _time
|  eval data1=20,data2=10,data3=30,data4=22,data5=11,data6=50
|  transpose column_name=myFieldName
|  rename "row 1" as myCountField