Creating Pie Charts

Pie charts are a simple and effective way to visualize data. DNIF offers pie charts in simple and stacked versions.

In this example, we shall investigate a sample of hits serviced by our website (Apache2 server). So we are looking for successful requests from $LogType=WEBSERVER and $EventID=200. To further narrow down on this data set, we will restrict ourselves to a maximum of 1000 rows generated within the last 24 hours. In this simple pie chart example, we will be looking for the top countries that we have received hits from. Here is the query we will use.

_fetch * from event where $LogType=WEBSERVER AND $EventID=200 AND $Duration=24h limit 1000
>>_agg count_unique $SrcCN
>>_sort by count_unique DESC

Pick $SrcCN in the “Primary Key” field and pick count_unique in the “Value” field. Hit “Update Chart” to see your visualization on the right.

This image has built a stacked (2 dimensional) pie chart. Let’s say that, in addition to the countries, we also want to look at the different ISPs that have interacted with our website. We only slightly modify our query here.

_fetch * from event where $LogType=WEBSERVER AND $EventID=200 AND $Duration=24h limit 1000
>>_agg count_unique $SrcCN, $SrcISP
>>_sort by count_unique DESC

Since there is a second dimension here, we will use the secondary key to portray the second dimension. Go ahead and pick $SrcISP from the “Secondary Key” field and then “Update Chart” to see it render. The pie chart will show up with two layers, the inner layer being the countries and the outer layer shows ISPs within those countries.

And with that, you’re ready to experiment more with pie charts!