Use a pie chart to show how different field values combine over an entire data set. Each slice of a pie chart represents the relative importance or volume of a particular category.
Pie charts represent a single data series.
Use a transforming command in a search to generate the single series.
For example, count events in each
source field category.
...| stats count by source
Check the Statistics table after running the search to make sure that a single series generated. The table should have two columns.
The example search generates the following table.
The first table column contains labels for each pie slice. The second column contains the numerical values that correspond to each label. The numerical values determine the relative size of each slice.
If the search generates a table with more than two columns, the extra columns are ignored.
You can use the Format menu to configure the following pie chart components.
Drilldown in a pie chart lets users click on a pie slice to open a secondary search using the clicked values. You can enable or disable drilldown in the Dashboard editor. See Use drilldown for dashboard interactivity for more details.
Set a minimum percentage size to apply when there are more than 10 slices. Data values below the minimum percentage are combined into an other slice.
Create a pie chart
Review the following details about building pie charts.
- Write a search that uses a transforming command to aggregate values in a field.
- Run the search.
- Select the Statistics tab below the search bar. The statistics table here should have two columns.
- Select the Visualization tab and use the Visualization Picker to select the pie chart visualization.
- (Optional) Use the Format menu to configure the visualization.
This search portion aggregates events by
Code field values.
... | stats count by Code
The search generates a single data series representing values in the
The chart is configured with a 5% minimum size. Field values that represent less than 5% of the total data set are combined into an other slice.
This search uses the
source fields to generate a single series.
index = _internal | chart avg(bytes) over source
source column provides pie slice labels. The
avg(bytes) column provides the relative size of each slice, as percentages of the sum of
avg(bytes) returned by the search.
Data for charts
Column and bar charts
This documentation applies to the following versions of Splunk® Enterprise: 6.6.0, 6.6.1, 6.6.2