Splunk Search

Is it possible to make a pie chart with pre calculated percentage values?


Hello all,

I am trying to make a pie chart with already calculated percentage values and am wondering if this if possible. Currently, this is my code, but it seems to try to make a new percentage out of my already calculated percentages:

Index= | convert num(PercentTimeOnPrem) | convert num(PercentTimeOffPrem) | convert num(PercentTimeOnVPN)| convert num(PercentTimeIdle) | Where PercentTimeOnPrem <= 100 | stats avg(PercentTimeOnPrem) as "Percent in Office", avg(PercentTimeOffPrem) as "Percent Out of Office", avg(PercentTimeIdle) as "Percent Time Idle", avg(PercentTimeOnVPN) as "Percent on VPN" | transpose

Any help would be greatly appreciated.

Thank you!

0 Karma

Path Finder

Is this sort of what you're looking for?

| makeresults | eval PercentTimeOnPrem = 50 | eval PercentTimeOffPrem = 25 | eval PercentTimeOnVPN = 15 | eval PercentTimeIdle=10 | fields - _time | stats values(PercentTimeOnPrem) as "Percent in Office" values(PercentTimeOffPrem) as "Percent Out of Office" values(PercentTimeIdle) as "Percent Time Idle" values(PercentTimeOnVPN) as "Percent on VPN"| transpose

To have a pie chart, all you need is too columns. One with labels and one with values.

Your stats table should look like this:

Label | Value
Percent in Office | 50
Percent Out of Office | 25
Percent Time Idle | 10
Percent on VPN | 15

0 Karma


Since it is calculated automatically, it is necessary to change the query.

0 Karma