Donut or pie charts are useful for visually comparing the percentage of events that have occurred, such as the type of error that occurs the most in your system. To create a donut or pie chart, use a search query that provides at least a few data points in the Aggregates tab.
For example, you could use the following query to create a simple bar chart:
(error OR fail*) AND exception | count by _sourceCategory | sort by _count
which would produce results such as:
Create a Donut or Pie Chart
- Run a query.
- In the Aggregates tab, choose the Pie Chart icon to display the search results.
The data in the Aggregates tab is represented as a pie chart.
Modify a Donut or Pie Chart
- In the Search page, on the Aggregates tab, select the Settings icon.
- Select Change Properties. Change any of the following:
- Display. Default chart style is a donut. To change to a pie chart, deactivate the check box.
- Label Truncation. To change the way labels are truncated, choose either End or Middle. If you choose End label truncation, it means that a value, such as an IP address, could be shortened to 100.100...., so that the beginning of the value is retained. Choosing Middle means that an IP address could be shortened to 100....100, so that the beginning and the end of the value is retained.
- Slice Borders. Show a border between each slice color. This border will match the color theme you have selected for your dashboard.
- Maximum Number of Slices. Enter a maximum number of slices.
- Click Save.