Splunk Search

Is it possible to make a pie chart with pre calculated percentage values?

jregruit
Engager

Hello all,

I am trying to make a pie chart with already calculated percentage values and am wondering if this if possible. Currently, this is my code, but it seems to try to make a new percentage out of my already calculated percentages:

Index= | convert num(PercentTimeOnPrem) | convert num(PercentTimeOffPrem) | convert num(PercentTimeOnVPN)| convert num(PercentTimeIdle) | Where PercentTimeOnPrem <= 100 | stats avg(PercentTimeOnPrem) as "Percent in Office", avg(PercentTimeOffPrem) as "Percent Out of Office", avg(PercentTimeIdle) as "Percent Time Idle", avg(PercentTimeOnVPN) as "Percent on VPN" | transpose

Any help would be greatly appreciated.

Thank you!

0 Karma

stoutrw
Path Finder

Is this sort of what you're looking for?

| makeresults | eval PercentTimeOnPrem = 50 | eval PercentTimeOffPrem = 25 | eval PercentTimeOnVPN = 15 | eval PercentTimeIdle=10 | fields - _time | stats values(PercentTimeOnPrem) as "Percent in Office" values(PercentTimeOffPrem) as "Percent Out of Office" values(PercentTimeIdle) as "Percent Time Idle" values(PercentTimeOnVPN) as "Percent on VPN"| transpose

To have a pie chart, all you need is too columns. One with labels and one with values.

Your stats table should look like this:

Label | Value
~~~~
Percent in Office | 50
Percent Out of Office | 25
Percent Time Idle | 10
Percent on VPN | 15

0 Karma

to4kawa
Ultra Champion

Since it is calculated automatically, it is necessary to change the query.

0 Karma
Get Updates on the Splunk Community!

What the End of Support for Splunk Add-on Builder Means for You

Hello Splunk Community! We want to share an important update regarding the future of the Splunk Add-on Builder ...

Solve, Learn, Repeat: New Puzzle Channel Now Live

Welcome to the Splunk Puzzle PlaygroundIf you are anything like me, you love to solve problems, and what ...

Building Reliable Asset and Identity Frameworks in Splunk ES

 Accurate asset and identity resolution is the backbone of security operations. Without it, alerts are ...