To alter the type of chart on the PDF you can find the search in the savedsearches.conf file. At the bottom of the search you will find a vsid=(some set of char). This is the view state ID. Open the viewstates.conf file in the same app and find the corresponding view. If it is a flashtimeline: (that VSID number) the second line down should be ChartTypeFormatter_0_14_0.default = (Chart Type). By changing this value to pie chart you should get the results you are looking for. You can also use the GUI described in this link http://docs.splunk.com/Documentation/Splunk/5.0.4/Viz/Savingreportsandsharingthemwithothers ... View more