Pie chart
Use a pie chart to show how different field values combine over an entire data set. Each slice of a pie chart represents the relative importance or volume of a particular category.
Data formatting
Pie charts represent a single data series.
Use a transforming command in a search to generate the single series.
For example, count events in each source
field category.
...| stats count by source
Check the Statistics table after running the search to make sure that a single series generated. The table should have two columns.
The example search generates the following table.
The first table column contains labels for each pie slice. The second column contains the numerical values that correspond to each label. The numerical values determine the relative size of each slice.
If the search generates a table with more than two columns, the extra columns are ignored.
Configuration options
You can use the Format menu to configure the following pie chart components.
Drilldown
Drilldown in a pie chart lets users click on a pie slice to open a secondary search using the clicked values. You can enable or disable drilldown in the Dashboard editor. See Use drilldown for dashboard interactivity for more details.
Minimum size
Set a minimum percentage size to apply when there are more than 10 slices. Data values below the minimum percentage are combined into an other slice.
Create a pie chart
Prerequisites
Review the following details about building pie charts.
Steps
- Write a search that uses a transforming command to aggregate values in a field.
- Run the search.
- Select the Statistics tab below the search bar. The statistics table here should have two columns.
- Select the Visualization tab and use the Visualization Picker to select the pie chart visualization.
- (Optional) Use the Format menu to configure the visualization.
Examples
This search portion aggregates events by Code
field values.
... | stats count by Code
The search generates a single data series representing values in the Code
field.
The chart is configured with a 5% minimum size. Field values that represent less than 5% of the total data set are combined into an other slice.
This search uses the bytes
and source
fields to generate a single series.
index = _internal | chart avg(bytes) over source
Here, the source
column provides pie slice labels. The avg(bytes)
column provides the relative size of each slice, as percentages of the sum of avg(bytes)
returned by the search.
Data for charts | Column and bar charts |
This documentation applies to the following versions of Splunk Cloud Platform™: 9.2.2406 (latest FedRAMP release), 8.2.2201, 8.2.2203, 8.2.2112, 8.2.2202, 9.0.2205, 9.0.2208, 9.0.2209, 9.0.2303, 9.0.2305, 9.1.2308, 9.1.2312, 9.2.2403
Feedback submitted, thanks!