Splunk Search

help me with Pie Chart

sravankaripe
Communicator

----------------------| stats count by status | eval status=" Status: ".status.", Count : ".count|makemv delim="," status

alt text

in above pie chart it showing

Status: 200, Count: 10
---------------------------
Status: 400 Count: 20
---------------------------

i want to display it as
Status: 200
Count: 10
---------------------------
Status: 400
Count: 20
---------------------------

please help me with this

Tags (2)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Try this. The makemv command is not needed.

... | stats count by status | eval status=" Status: ".status."\nCount : ".count
---
If this reply helps you, Karma would be appreciated.

View solution in original post

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Try this. The makemv command is not needed.

... | stats count by status | eval status=" Status: ".status."\nCount : ".count
---
If this reply helps you, Karma would be appreciated.
0 Karma

sravankaripe
Communicator

No, its not working
i am got search result like this
Status: 200\nCount : 10
Status: 302\nCount : 20

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Sorry, I thought that would work.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...

Ready, Set, SOAR: How Utility Apps Can Up Level Your Playbooks!

 WATCH NOW Powering your capabilities has never been so easy with ready-made Splunk® SOAR Utility Apps. Parse ...