Search code examples
sumologic

Creating SUMO logic pie chart with SUM totals

I would like to create a SUMO logic pie chart however I am having difficultu doing it with SUM totals. below you can see my query

_sourceCategory=MyAppSource
| parse "* [*] {\"machineName\":*,\"requestPath\":*,\"requestMethod\":*,\"requestSize\":*,\"requestType\":*,\"service\":*,\"duration\":*,\"stack\":*,\"errorMessage\":*,\"errorObject\":*,\"userName\":*,\"clientId\":*,\"statusCode\":*,\"traceIdentifier\":*}" as TimeStamp,Subject,MachineName,RequestPath,RequestMethod,RequestSize,RequestType,Service,Duration,Stack,ErrorMessage,ErrorObject,UserName,ClientID,StatusCode,TraceIdentifier
| if (Duration >= 40, 1, 0) as RequestTimeGreaterThan40ms
| if (Duration < 40, 1, 0) as RequestTimeUnder40ms 
| sum(RequestTimeGreaterThan40ms) as RequestTimeGreaterThan40ms, sum(RequestTimeUnder40ms) as RequestTimeUnder40ms
| RequestTimeGreaterThan40ms + RequestTimeUnder40ms as TotalRequest
| (RequestTimeGreaterThan40ms/TotalRequest)*100 as RequestTimeGreaterThan40ms
| (RequestTimeUnder40ms/TotalRequest)*100 as RequestTimeUnder40ms

This produces this result:

enter image description here

However when I look at my pie chart it looks like this

enter image description here

My question: As you can see my issue is that the pie chart is only grabbing the first value which would be 4.03717 and nothing else. I need to transpose the other columns into rows so that the pie chart can understand that these are different values and they all need to be represented in the pie chart. Does anyone know what would be the best way to do this?

Solution

  • I think the problem with your approach is that you end up counting the requests above-40-ms and below-40-ms in two separate "categories", so then it's hard to "join" them (sorry for not too precise wording).

    The cleaner way would be to use single aggregation (not double):

    _sourceCategory=MyAppSource
| parse "* [*] {\"machineName\":*,\"requestPath\":*,\"requestMethod\":*,\"requestSize\":*,\"requestType\":*,\"service\":*,\"duration\":*,\"stack\":*,\"errorMessage\":*,\"errorObject\":*,\"userName\":*,\"clientId\":*,\"statusCode\":*,\"traceIdentifier\":*}" as TimeStamp,Subject,MachineName,RequestPath,RequestMethod,RequestSize,RequestType,Service,Duration,Stack,ErrorMessage,ErrorObject,UserName,ClientID,StatusCode,TraceIdentifier
| if (Duration >= 40, "greater", "under") as RequestTimeVs40ms
| count by RequestTimeVs40ms

    (Disclaimer: I am currently employed by Sumo Logic)