Splunk Search

Intersect, Diff and Pie Chart

belka
Path Finder

I have a very large number of win7 machines. I pulled a CSV file from Active Directory, AD1.csv. I then created another CSV file from the deployment clients DC1.csv. What I want to do is compare the total number of clients with the number reporting in with deployment clients. I want a Pie Chart that is the total number of Win7 machines split between a slice that is the machines with deployment clients and a slice that are the machines without a deployment client.

I was experimenting with | set diff [inputlookup AD1.csv | fields hostname][inputlookup DC1.csv | fields hostname] Where I am stumped is how to make that into a pie chart. Any ideas? Thanks!

Tags (3)
0 Karma

somesoni2
Revered Legend

Try this

|inputlookup AD1.csv | fields hostname | join type=left hostname [|inputlookup DC1.csv | fields hostname | eval hasDC="Y"] | eval hasDC=coalesce(hasDC,"N") | chart count(eval(hasDC="Y")) as HasDC, count(eval(hasDC="N")) as NoDC
Get Updates on the Splunk Community!

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...

🔐 Trust at Every Hop: How mTLS in Splunk Enterprise 10.0 Makes Security Simpler

From Idea to Implementation: Why Splunk Built mTLS into Splunk Enterprise 10.0  mTLS wasn’t just a checkbox ...