I got a splunk search that monitors, how many different hosts there were in the chosen timespan.
| stats dc(host) as hostcount
Now I would like to generate a pie chart, that compares succesful hosts with the unseccesful ones. Therefore I got a field "errors". All hosts with error > 50 should be counted as unseccesful. The others should be counted as succesful. The pie chart should show the succesful/unsuccesful ratio.
Thank you, that already helps. However I did a mistake while explaining my situation. I dont want the sum of errors to be > 50. If there was one event with error >50 within the timespan, the host should be classified unsuccesful. The sum of errors per host is not important for me. Only if there was one single event with error >50. Do you understand what I mean?