Splunk Search

Piechart split for selected hostname?

super_edition
Path Finder

Hello Everyone,

I am trying to create piechart for cache operation split(in percentage) for hit/miss/pass using the below query for the selected hostname:

 

index="my_index" openshift_container_name="container" 
| eval description=case(handling == "hit","HIT", handling == "miss","MISS", handling == "pass","PASS")
| search hostname="int-ie-yyp.grp"
| addtotals
| eval cache_hit=round(100*HIT/Total,1)
| eval cache_miss=round(100*MISS/Total,1)
| eval cache_pass=round(100*PASS/Total,1)

 


When I try with:

 

| stats values(cache_hit) as cacheHit values(cache_miss) as cacheMiss values(cache_pass) as cachePass by description

 

 no data is generated.

super_edition_0-1688638043231.png

However when I try for count it works:

 

| stats count by description

 

super_edition_1-1688638447379.png

Can someone please help.

 



Labels (2)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
| stats count by description
| eventstats sum(count) as Total
| eval percent=100*count/Total
| fields description percent

View solution in original post

0 Karma

super_edition
Path Finder

Its working as expected. Thank you @ITWhisperer 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| stats count by description
| eventstats sum(count) as Total
| eval percent=100*count/Total
| fields description percent
0 Karma
Get Updates on the Splunk Community!

AI for AppInspect

We’re excited to announce two new updates to AppInspect designed to save you time and make the app approval ...

App Platform's 2025 Year in Review: A Year of Innovation, Growth, and Community

As we step into 2026, it’s the perfect moment to reflect on what an extraordinary year 2025 was for the Splunk ...

Operationalizing Entity Risk Score with Enterprise Security 8.3+

Overview Enterprise Security 8.3 introduces a powerful new feature called “Entity Risk Scoring” (ERS) for ...