Hi krsuraj11, are you speaking about a screenshot of a dashboard or a link to the dashboard? if you wanto to send a screenshot of a dashboard, you can schedule to send a dashboard by eMail, but only dashboards without filters (it's a different way to send a report!). If you want to send a link, you can eMail the url of your dashboard but your seniors must be logged in. Bye. Giuseppe ... View more

@krsuraj11 Also post some sample data. With your current query what is the output you are having? You may want append instead of appendcols (subsearch may not be required at all, however, community would be able to assist you better only if you provide your current query and sample data). If you just want to be done with your use case, you can pipe a transpose command at the end of your current query and you should be able to see pie chart. Please try out and confirm (however, this may not be the most optimized way of writing SPL). <yourCurrentSearch> | transpose Following is a run anywhere example to transform columns to rows using transpose which ca: | makeresults | fields - _time | eval data1=20,data2=10,data3=30,data4=22,data5=11,data6=50 | transpose column_name=myFieldName | rename "row 1" as myCountField ... View more

try and use this formula, here i use wild cards in eval %Fail% you might not need. | makeresults count=1000 | eval random_for_text = random()%2 | eval text_to_search = if(random_for_text=="0","Failure","EFGH") | stats count(eval(like(text_to_search,"%Fail%"))) as fail_count count(eval(like(text_to_search, "%EF%"))) as efgh_count in your case itll be maybe something like this: index="indexsplunk" host=host* tag="Failure" "Transaction" ("Failure" OR "EFGH") | stats count(eval(like(_raw,"Failure"))) as fail_count count(eval(like(_raw, "EFGH"))) as efgh_count hope it helps ... View more