How to make pie chart of these values in Splunk

Question

Have the following query index=app (splunk_server_group=bex OR splunk_server_group=default) sourcetype=rpm-web* host=rpm-web* "CACHE_NAME=RATE_SHOPPER" method = GET | stats count(eval(searchmatch("true))) as Hit, count(eval(searchmatch("found=false"))) as Miss

Need to make a pie chart of two values "Hit and Miss rates"

The field where it is possible to distinguish the values is Message=[CACHE_NAME=RATE_SHOPPER some_other_strings method=GET found=false]. or found can be true

Answer 1

With out knowing the structure of your data it's harder to say what exactly you need todo but, Pie charts is a single data series so you need to use a transforming command to generate a single series. PieChart Doc

if you have a field that denotes a hit or miss (You could use an Eval statement to create one if you don't already have this) you can use it to create the single series like this.

Lets say this field is called result.

|stats count by result

Here is a link to the documentation for the Eval Command

Good luck, hope you can get the results your looking for

Answer 2

Pie charts require a single field so it's not possible to graph the Hit and Miss fields in a pie. However, if the two fields are combined into one field with two possible values, then it will work.

index=app (splunk_server_group=bex OR splunk_server_group=default) sourcetype=rpm-web* host=rpm-web* "CACHE_NAME=RATE_SHOPPER" method = GET 
| eval result=if(searchmatch("found=true"), "Hit", "Miss")
| stats count by result

Answer 3

Since you seem to be concerned only about whether "found" equals either "hit" or "miss", try this:

index=app (splunk_server_group=bex OR splunk_server_group=default) sourcetype=rpm-web* host=rpm-web* "CACHE_NAME=RATE_SHOPPER" method=GET found IN("hit","miss")
| stats count by found