Splunk Search

Is it possible to make a pie chart with pre calculated percentage values?

jregruit
Engager

Hello all,

I am trying to make a pie chart with already calculated percentage values and am wondering if this if possible. Currently, this is my code, but it seems to try to make a new percentage out of my already calculated percentages:

Index= | convert num(PercentTimeOnPrem) | convert num(PercentTimeOffPrem) | convert num(PercentTimeOnVPN)| convert num(PercentTimeIdle) | Where PercentTimeOnPrem <= 100 | stats avg(PercentTimeOnPrem) as "Percent in Office", avg(PercentTimeOffPrem) as "Percent Out of Office", avg(PercentTimeIdle) as "Percent Time Idle", avg(PercentTimeOnVPN) as "Percent on VPN" | transpose

Any help would be greatly appreciated.

Thank you!

0 Karma

stoutrw
Path Finder

Is this sort of what you're looking for?

| makeresults | eval PercentTimeOnPrem = 50 | eval PercentTimeOffPrem = 25 | eval PercentTimeOnVPN = 15 | eval PercentTimeIdle=10 | fields - _time | stats values(PercentTimeOnPrem) as "Percent in Office" values(PercentTimeOffPrem) as "Percent Out of Office" values(PercentTimeIdle) as "Percent Time Idle" values(PercentTimeOnVPN) as "Percent on VPN"| transpose

To have a pie chart, all you need is too columns. One with labels and one with values.

Your stats table should look like this:

Label | Value
~~~~
Percent in Office | 50
Percent Out of Office | 25
Percent Time Idle | 10
Percent on VPN | 15

0 Karma

to4kawa
Ultra Champion

Since it is calculated automatically, it is necessary to change the query.

0 Karma
Get Updates on the Splunk Community!

Building Reliable Asset and Identity Frameworks in Splunk ES

 Accurate asset and identity resolution is the backbone of security operations. Without it, alerts are ...

Cloud Monitoring Console - Unlocking Greater Visibility in SVC Usage Reporting

For Splunk Cloud customers, understanding and optimizing Splunk Virtual Compute (SVC) usage and resource ...

Automatic Discovery Part 3: Practical Use Cases

If you’ve enabled Automatic Discovery in your install of the Splunk Distribution of the OpenTelemetry ...