Splunk Search

Is it possible to make a pie chart with pre calculated percentage values?

jregruit
Engager

Hello all,

I am trying to make a pie chart with already calculated percentage values and am wondering if this if possible. Currently, this is my code, but it seems to try to make a new percentage out of my already calculated percentages:

Index= | convert num(PercentTimeOnPrem) | convert num(PercentTimeOffPrem) | convert num(PercentTimeOnVPN)| convert num(PercentTimeIdle) | Where PercentTimeOnPrem <= 100 | stats avg(PercentTimeOnPrem) as "Percent in Office", avg(PercentTimeOffPrem) as "Percent Out of Office", avg(PercentTimeIdle) as "Percent Time Idle", avg(PercentTimeOnVPN) as "Percent on VPN" | transpose

Any help would be greatly appreciated.

Thank you!

0 Karma

stoutrw
Path Finder

Is this sort of what you're looking for?

| makeresults | eval PercentTimeOnPrem = 50 | eval PercentTimeOffPrem = 25 | eval PercentTimeOnVPN = 15 | eval PercentTimeIdle=10 | fields - _time | stats values(PercentTimeOnPrem) as "Percent in Office" values(PercentTimeOffPrem) as "Percent Out of Office" values(PercentTimeIdle) as "Percent Time Idle" values(PercentTimeOnVPN) as "Percent on VPN"| transpose

To have a pie chart, all you need is too columns. One with labels and one with values.

Your stats table should look like this:

Label | Value
~~~~
Percent in Office | 50
Percent Out of Office | 25
Percent Time Idle | 10
Percent on VPN | 15

0 Karma

to4kawa
Ultra Champion

Since it is calculated automatically, it is necessary to change the query.

0 Karma
Get Updates on the Splunk Community!

The All New Performance Insights for Splunk

Splunk gives you amazing tools to analyze system data and make business-critical decisions, react to issues, ...

Good Sourcetype Naming

When it comes to getting data in, one of the earliest decisions made is what to use as a sourcetype. Often, ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...