try pie chart use the query ending with
| stats count by STATUS | eval STATUS=ID."-".ALERT."-".ALERT_RESOURCE."-".ACCOUNT."-".ACCOUNT_NAME."-".REGION."-".MESSAGE."-".SIGNATURE_DESC."-".SIGNATURE_RESOLUTION."-".STATUS."-".RISK_LEVEL."-".STARTED ENDED ARN