Automatically create visualizations from multiple unique field counts in descending order


(Sbienert) #1

I want to have multiple pie charts in one visualization looking like this:

I have logs with many EventIDs which all contain SubIDs. Now I want to create a pie chart for each eventId value which slices are splitted by the count of the contained SubIDs. The chart with the highest amount of logs should be displayed at the very first place (left) so in descending order.

Since there are more than 100 eventIds it would be very annoying to create one chart for each EventID. So is it possible to do it automatically and have all of the created charts in one widget in descending log count order?

Thank you in advance


(Thomas Neirynck) #2

hi @sbienert,

I think you should be able to.

In the aggregations, nest your aggregations from high level to low level.

So, do "split charts" on the EventID first, then do "split slices" on the subIds. Your metric is Count. That should produce a visualization that roughly looks like that picture.


(Sbienert) #3

Yes, thank you. Did not know it was that easy. I will keep the topic open for a couple days after I tested i more thoroughly.


(system) #4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.