Splunk Search

Is it possible to make a pie chart with pre calculated percentage values?


Hello all,

I am trying to make a pie chart with already calculated percentage values and am wondering if this if possible. Currently, this is my code, but it seems to try to make a new percentage out of my already calculated percentages:

Index= | convert num(PercentTimeOnPrem) | convert num(PercentTimeOffPrem) | convert num(PercentTimeOnVPN)| convert num(PercentTimeIdle) | Where PercentTimeOnPrem <= 100 | stats avg(PercentTimeOnPrem) as "Percent in Office", avg(PercentTimeOffPrem) as "Percent Out of Office", avg(PercentTimeIdle) as "Percent Time Idle", avg(PercentTimeOnVPN) as "Percent on VPN" | transpose

Any help would be greatly appreciated.

Thank you!

0 Karma

Path Finder

Is this sort of what you're looking for?

| makeresults | eval PercentTimeOnPrem = 50 | eval PercentTimeOffPrem = 25 | eval PercentTimeOnVPN = 15 | eval PercentTimeIdle=10 | fields - _time | stats values(PercentTimeOnPrem) as "Percent in Office" values(PercentTimeOffPrem) as "Percent Out of Office" values(PercentTimeIdle) as "Percent Time Idle" values(PercentTimeOnVPN) as "Percent on VPN"| transpose

To have a pie chart, all you need is too columns. One with labels and one with values.

Your stats table should look like this:

Label | Value
Percent in Office | 50
Percent Out of Office | 25
Percent Time Idle | 10
Percent on VPN | 15

0 Karma


Since it is calculated automatically, it is necessary to change the query.

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!