Splunk Search

How can we edit our search to visualize results on a pie chart?

splunker9999
Path Finder

Hi,

We have the search below and are looking to view results in pie chart format. We are facing difficulties to visualize this with Pie chart. How do we edit our search to make this possible?

index=index sourcetype=hadoop: us.LogUtility | eval TotalTimeSolr = Solr_Personalized_Instore + Solr_Personalized_Online + Solr_NonPersonalized | eval TotalTimeHBase = Hbase_Card_Master + Hbase_Card_Upgrade_Info + Hbase_Cust_Info_Specialoffers + Hbase_Cust_Info_CMData + Hbase_Offer_Details + Hbase_Global_Offers_InfoEnrol + Hbase_Global_Offers_Info_Lob + Hbase_Cust_Info_Feedback + Hbase_Offer_Popular + Hbase_Offer_Random |where (TotalTime > 5000 OR TotalTimeSolr>5000 OR TotalTimeHBase>5000)
|eval TotalTime=if(TotalTime<5000,0,TotalTime)
|eval TotalTimeSolr=if(TotalTimeSolr<5000,0,TotalTimeSolr)
|eval TotalTimeHBase=if(TotalTimeHBase<5000,0,TotalTimeHBase)
|stats count(eval(TotalTime!=0)) as TotalTime count(eval(TotalTimeSolr!=0)) as SolrTime count(eval(TotalTimeHBase!=0)) as HBaseTime

Please advise or suggest if there is a way we can convert this.

0 Karma
1 Solution

somesoni2
Revered Legend

Try this

 index=index sourcetype=hadoop: us.LogUtility | eval TotalTimeSolr = Solr_Personalized_Instore + Solr_Personalized_Online + Solr_NonPersonalized | eval TotalTimeHBase = Hbase_Card_Master + Hbase_Card_Upgrade_Info + Hbase_Cust_Info_Specialoffers + Hbase_Cust_Info_CMData + Hbase_Offer_Details + Hbase_Global_Offers_InfoEnrol + Hbase_Global_Offers_Info_Lob + Hbase_Cust_Info_Feedback + Hbase_Offer_Popular + Hbase_Offer_Random |where (TotalTime > 5000 OR TotalTimeSolr>5000 OR TotalTimeHBase>5000)
 |eval TotalTime=if(TotalTime<5000,0,TotalTime)
 |eval TotalTimeSolr=if(TotalTimeSolr<5000,0,TotalTimeSolr)
 |eval TotalTimeHBase=if(TotalTimeHBase<5000,0,TotalTimeHBase)
 |stats count(eval(TotalTime!=0)) as TotalTime count(eval(TotalTimeSolr!=0)) as SolrTime count(eval(TotalTimeHBase!=0)) as HBaseTime
 | eval temp=1 | untable temp Metrics Value | fields - temp

View solution in original post

0 Karma

somesoni2
Revered Legend

Try this

 index=index sourcetype=hadoop: us.LogUtility | eval TotalTimeSolr = Solr_Personalized_Instore + Solr_Personalized_Online + Solr_NonPersonalized | eval TotalTimeHBase = Hbase_Card_Master + Hbase_Card_Upgrade_Info + Hbase_Cust_Info_Specialoffers + Hbase_Cust_Info_CMData + Hbase_Offer_Details + Hbase_Global_Offers_InfoEnrol + Hbase_Global_Offers_Info_Lob + Hbase_Cust_Info_Feedback + Hbase_Offer_Popular + Hbase_Offer_Random |where (TotalTime > 5000 OR TotalTimeSolr>5000 OR TotalTimeHBase>5000)
 |eval TotalTime=if(TotalTime<5000,0,TotalTime)
 |eval TotalTimeSolr=if(TotalTimeSolr<5000,0,TotalTimeSolr)
 |eval TotalTimeHBase=if(TotalTimeHBase<5000,0,TotalTimeHBase)
 |stats count(eval(TotalTime!=0)) as TotalTime count(eval(TotalTimeSolr!=0)) as SolrTime count(eval(TotalTimeHBase!=0)) as HBaseTime
 | eval temp=1 | untable temp Metrics Value | fields - temp

View solution in original post

0 Karma

splunker9999
Path Finder

Thanks, Works like a champ.

0 Karma

splunker9999
Path Finder

Hi, This is working ,but when ever 0 results found, I could see fields on Pie chart is visible(only with lines), can we some how hide those details.

I thought of hiding this panel when 0 results found by setting token $showpanel$,,but this panel is already depends on another panel , can we use 2 panel depends?

Thanks

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!