Pie chart

[ 1 Overview ] [ 2 What data do I need for this widget? ] [ 3 Creating a pie chart ] [ 4 Working with pie charts ] [ 5 Query example ]

Overview

A pie chart is a circular graph that contains slices that correspond to parts of the whole. The different slices of the chart and their proportions are defined by two given fields in your query.

What data do I need for this widget?

The option to create this chart will be disabled unless your query contains at least one column with numerical values.

Creating a pie chart

Working with pie charts

Hover over a portion to see the arguments and values it represents or click it to highlight it.

You can use the following options to visualize different aspects of your pie chart:

If your data is updated in realtime, the realtime toggle will appear at the top left. Activate it to update the chart with the new incoming data or deactivate it to keep the latest available data up to that moment.
Click the by period toggle to show the results per period, showing the latest available period by default and being able to move through the different periods (see the table below to know how).
- If your data is not grouped, you will see the results per distinct value, showing the latest available value by default and being able to move through them (see the table below to know how).
- If your data is grouped but not using a temporal aspect, you will see no difference when activating this option.
Adjust the Radius slider to change the size of the black circle in the centre (zero means no circle at all).
Increase or decrease the number in the % Hide Labels field to show a greater or fewer number of labels (zero means all labels will be shown while 100 means no label).
Click the legend drop-down and select an option to show in the labels either the values or the percentage they represent.
Click To Bytes to consider the values as bytes and add it as an extra piece of information to the labels, legend and tooltip.

You can hit the following keys to perform different visualization actions:

Shortcut key	Description

Shortcut key

Description

←

With the by period option activated:

If your data is grouped by period, displays the data from the previous period available. For example, if your query groups data every 30 seconds press the left arrow to see the data for the previous 30-second period available.
If your data is not grouped, displays the data from the previous distinct value available.

→

With the by period option activated:

If your data is grouped by period, displays the data from the next period available. For example, if your query groups data every 30 seconds press the right arrow to see the data for the next 30-second period available.
If your data is not grouped, displays the data from the next distinct value available.

?

Shows/hides the list of shortcut keys.

Query example

You can recreate the example shown in the picture above with the data from the following query and mapping the fields as follows:

from demo.ecommerce.data
  select str(statusCode) as statusCodeStr

Required field	Column added

Required field

Column added

Partitioning

statusCodeStr

Values

bytesTransferred

Realtime → deactivated

By period → deactivated

In case you want another example with the data grouped, here is another query to create it:

from siem.logtrust.web.activity
where isnotnull(srcHost)
group every 30m by country, method
  every 30m
  select count() as count

Required field	Column added

Required field

Column added

Partitioning

method/country

Values

count

Realtime → deactivated

By period → activated