Splunk Search

help for doing a pie chart from 2 subsearch

jip31
Motivator

hi

I have the search below

`test` 
    [| inputlookup host.csv 
    | table host 
    | rename host as USERNAME ] 
| lookup aps.csv NAME as AP_NAME OUTPUT Building  
| lookup cmdb.csv HOSTNAME as USERNAME output BUILDING_DESCRIPTION
| stats last(Building) as BuildingAP, last(BUILDING_DESCRIPTION) as BuildingIT 

What I need is to do a pie chart in order to have the percentage of the events where BuildingAP doesnt match with BuildingIT
So first, I have to write this where condition
After I need to count the number of events corresponding to this where condition and to count also the total number of events (events without the where condition) in order to have 2 news fields which allows doing a pie chart
but pearhaps there is another solution?
For summarize I need a pie chart with 2 label in %, one which calculate the % of events where BuildingAP is not equal to BuildingIT and another which is the equal tio the total % of events - the % the previous count
Is anybody cant help me please??

Tags (1)
0 Karma
1 Solution

diogofgm
SplunkTrust
SplunkTrust

Try something like this and change according to what you are trying to compare:

 `test` 
     [| inputlookup host.csv 
     | table host 
     | rename host as USERNAME ] 
| lookup aps.csv NAME as AP_NAME OUTPUT Building  
| lookup cmdb.csv HOSTNAME as USERNAME output BUILDING_DESCRIPTION
| eval isEqual = case(Building = BUILDING_DESCRIPTION,"true","false")
| stats count by isEqual 
------------
Hope I was able to help you. If so, some karma would be appreciated.

View solution in original post

jip31
Motivator

Ii there somebody for helping me please??

0 Karma

jip31
Motivator

Is anybody has an idea please??

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi jip31,
Try something like this:

`test` 
 [ | inputlookup host.csv 
   | table host 
   | rename host as USERNAME ] 
| lookup aps.csv NAME as AP_NAME OUTPUT Building  
| lookup cmdb.csv HOSTNAME as USERNAME output BUILDING_DESCRIPTION
| search NOT (Building = BUILDING_DESCRIPTION)
| stats count 

Bye.
Giuseppe

jip31
Motivator

Hi
I have no results (pie empty only....)

0 Karma

diogofgm
SplunkTrust
SplunkTrust

Try something like this and change according to what you are trying to compare:

 `test` 
     [| inputlookup host.csv 
     | table host 
     | rename host as USERNAME ] 
| lookup aps.csv NAME as AP_NAME OUTPUT Building  
| lookup cmdb.csv HOSTNAME as USERNAME output BUILDING_DESCRIPTION
| eval isEqual = case(Building = BUILDING_DESCRIPTION,"true","false")
| stats count by isEqual 
------------
Hope I was able to help you. If so, some karma would be appreciated.

jip31
Motivator

Hi
it doesnt works
I have the message " Error in 'eval' command: The arguments to the 'case' function are invalid."

0 Karma

diogofgm
SplunkTrust
SplunkTrust

can you try again? there was a typo on the case arguments (missing ")

------------
Hope I was able to help you. If so, some karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...