# Too dumb to create pie chart **URL:** \ **Category:** Graylog Central (peer support)\ **Created:** [May 26, 2022, 3:43am UTC](https://community.graylog.org/t/too-dumb-to-create-pie-chart/24022 "2022-05-26T03:43:56Z")\ **Posts on this page:** 20\ **Page:** 1
**Author:** ![mosman](https://avatars.discourse-cdn.com/v4/letter/m/c6cbf5/32.png) [@mosman](https://community.graylog.org/u/mosman)\ **Post date:** [May 26, 2022, 3:43am UTC](https://community.graylog.org/t/too-dumb-to-create-pie-chart/24022/1 "2022-05-26T03:43:56Z")
Hi, I seem to be unable to understand some concept of pie charts in a dashboard widget. I have a stream of messages, some of them have field A and some have field B (mutually exclusive, no message can have both fields). I now want to create a pie chart with the distribution of how many messages with field A compared to how many with field B. In essence the distribution of field A or B towards total count of messages. I create an aggregate widget with metric 1 being “count field A” and another one (metric 2) with “count field 2”. Visualization is “pie chart”. However, what I get is a widget with TWO pie charts, both being 100%. What I want is ONE pie with i.e. 60% A and 40% B… What am I doing wrong? I am using Graylog 4.2.8 free edition, and I cannot find any trace of “quick value”… ---
**Author:** ![gsmith](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/gsmith/32/1222_2.png) [@gsmith](https://community.graylog.org/u/gsmith)\ **Post date:** [May 26, 2022, 4:00am UTC](https://community.graylog.org/t/too-dumb-to-create-pie-chart/24022/2 "2022-05-26T04:00:28Z")
Hello, First of all, I like the title to this post. 😆 You looking for some like this? ![image](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/2X/c/c808596fd3e1cfda7b6d1ec2f981f03ce8711eef.png) ---
**Author:** ![mosman](https://avatars.discourse-cdn.com/v4/letter/m/c6cbf5/32.png) [@mosman](https://community.graylog.org/u/mosman)\ **Post date:** [May 26, 2022, 4:02am UTC](https://community.graylog.org/t/too-dumb-to-create-pie-chart/24022/3 "2022-05-26T04:02:36Z")
Thanks, I openly admit when I am incapable. Saves lot of time… Anyway. No, this is the result I get; I do want to have ONE Pie. The total pie represents the total number of messages, one part of that pie the number of messages with field A and the rest of that pie (obviously) the number of messages with field B. ---
**Author:** ![gsmith](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/gsmith/32/1222_2.png) [@gsmith](https://community.graylog.org/u/gsmith)\ **Post date:** [May 26, 2022, 4:11am UTC](https://community.graylog.org/t/too-dumb-to-create-pie-chart/24022/4 "2022-05-26T04:11:37Z")
@mosman Understood, so something like this? ![image](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/2X/9/97f86edb5e55d0094d0203d1361b224834514ee0.png) I would duplicate it for you but I dont think i have the same fields ---
**Author:** ![mosman](https://avatars.discourse-cdn.com/v4/letter/m/c6cbf5/32.png) [@mosman](https://community.graylog.org/u/mosman)\ **Post date:** [May 26, 2022, 4:22am UTC](https://community.graylog.org/t/too-dumb-to-create-pie-chart/24022/5 "2022-05-26T04:22:32Z")
Yes, quite so. Is the trick the two times grouping? I tried it but there will not even be a pie displayed… Group1 is “Field A”, limit 15 Group2 is “Field B”, limit 15 Metric is “count” with no field, no name Vis is “Pie chart” ---
**Author:** ![gsmith](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/gsmith/32/1222_2.png) [@gsmith](https://community.graylog.org/u/gsmith)\ **Post date:** [May 26, 2022, 4:30am UTC](https://community.graylog.org/t/too-dumb-to-create-pie-chart/24022/6 "2022-05-26T04:30:51Z")
@mosman Been playing around in the lab I came up with this. ![image](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/2X/5/5e2cec0ff91f0d14cd07c852aac31db6c86325af.png) > [@mosman](#): > > Yes, quite so. Is the trick the two times grouping? Yes > [@mosman](#): > > I tried it but there will not even be a pie displayed… Check the time frame your searching, 5 minutes, 15 minutes, etc… maybe increase it. ![image](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/2X/f/f2221b0fd16eea23506b95c1e12902774b477161.png) ---
**Author:** ![mosman](https://avatars.discourse-cdn.com/v4/letter/m/c6cbf5/32.png) [@mosman](https://community.graylog.org/u/mosman)\ **Post date:** [May 26, 2022, 4:32am UTC](https://community.graylog.org/t/too-dumb-to-create-pie-chart/24022/7 "2022-05-26T04:32:10Z")
Nope, does not work here. Plenty of messages, I know that ![image](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/2X/d/d35c28cd5dacf4ed1839718091a4a1bd9d7b3cba.png) ---
**Author:** ![gsmith](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/gsmith/32/1222_2.png) [@gsmith](https://community.graylog.org/u/gsmith)\ **Post date:** [May 26, 2022, 4:33am UTC](https://community.graylog.org/t/too-dumb-to-create-pie-chart/24022/8 "2022-05-26T04:33:03Z")
Oh wait, I have netflow fields. Let me check real quick ---
**Author:** ![mosman](https://avatars.discourse-cdn.com/v4/letter/m/c6cbf5/32.png) [@mosman](https://community.graylog.org/u/mosman)\ **Post date:** [May 26, 2022, 4:33am UTC](https://community.graylog.org/t/too-dumb-to-create-pie-chart/24022/9 "2022-05-26T04:33:34Z")
Tnx. I want the percentage of IPv4 vs. IPv6… ---
**Author:** ![gsmith](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/gsmith/32/1222_2.png) [@gsmith](https://community.graylog.org/u/gsmith)\ **Post date:** [May 26, 2022, 4:36am UTC](https://community.graylog.org/t/too-dumb-to-create-pie-chart/24022/10 "2022-05-26T04:36:52Z")
Ok , one problem I don’t have Ipv\_6 fields here is my results for IPv\_4 ![image](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/2X/7/7c644823ee6af02b9b0ea0e71153de60be256c38.png) I actually did a global search for **IPV6** and it came up empty. EDIT; Sorry I upload the wrong pic, i just replaced it ---
**Author:** ![mosman](https://avatars.discourse-cdn.com/v4/letter/m/c6cbf5/32.png) [@mosman](https://community.graylog.org/u/mosman)\ **Post date:** [May 26, 2022, 4:42am UTC](https://community.graylog.org/t/too-dumb-to-create-pie-chart/24022/11 "2022-05-26T04:42:31Z")
Strange, does not work at all here. Your example does work, sort of. It shows me four portions of the pie. With different IP-Address groups. To stay with that example; I’d like a pie that gives me the amount of ipv4\_dst fields and the amount of ipv4\_src fields. Yes, I know that that then must be a pie with 50/50 but that should illustrate the pie I want ---
**Author:** ![gsmith](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/gsmith/32/1222_2.png) [@gsmith](https://community.graylog.org/u/gsmith)\ **Post date:** [May 26, 2022, 4:49am UTC](https://community.graylog.org/t/too-dumb-to-create-pie-chart/24022/12 "2022-05-26T04:49:39Z")
@mosman Ok this is my last one, I tried multiple ways of achieving this. Grafana is much easier Last attempt ![image](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/2X/5/59244295cf79b41b2e5f837441e1144194247f07.png) That the best I can do for ya ---
**Author:** ![mosman](https://avatars.discourse-cdn.com/v4/letter/m/c6cbf5/32.png) [@mosman](https://community.graylog.org/u/mosman)\ **Post date:** [May 26, 2022, 4:55am UTC](https://community.graylog.org/t/too-dumb-to-create-pie-chart/24022/13 "2022-05-26T04:55:45Z")
Bugger. Still an empty pie. I just checked that I have plenty of messages with either ipv4 or ipv6 fields… If I do your example it still does not work as desired. It will give me the count of address pairs, i.e. 192.168.1.1-192.168.2.1 and 192.168.2.2-192.168.3.1 and the distribution in the packets. But for ipv6\_dst and ipv4\_src plain nothing. ---
**Author:** ![gsmith](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/gsmith/32/1222_2.png) [@gsmith](https://community.graylog.org/u/gsmith)\ **Post date:** [May 26, 2022, 5:01am UTC](https://community.graylog.org/t/too-dumb-to-create-pie-chart/24022/14 "2022-05-26T05:01:31Z")
Il try more tomorrow, If I come up with something Ill post it for ya. Maybe someone else here has done it before. ---
**Author:** ![mosman](https://avatars.discourse-cdn.com/v4/letter/m/c6cbf5/32.png) [@mosman](https://community.graylog.org/u/mosman)\ **Post date:** [May 26, 2022, 5:02am UTC](https://community.graylog.org/t/too-dumb-to-create-pie-chart/24022/15 "2022-05-26T05:02:15Z")
Thank you anyway for that. ---
**Author:** ![gsmith](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/gsmith/32/1222_2.png) [@gsmith](https://community.graylog.org/u/gsmith)\ **Post date:** [May 27, 2022, 3:45am UTC](https://community.graylog.org/t/too-dumb-to-create-pie-chart/24022/16 "2022-05-27T03:45:02Z")
Hello, Did some labbing, but was unable to create a widget that you want for the two fields. Long, long time ago there used to be a setting called “Quick Values” Sort what was talked about here… > > > Beginning with Graylog Version 3.2, I am missing a daily used feature > > \*\*Pre V…ers 3.2 had "quick values\*\*" > > quick value show both: > a) percentage and > b) count > of a field value > > I really felt in love with this table having percentage and count value in one row. > Number one usage for investigations! > !\[grafik\](https://user-images.githubusercontent.com/46027642/78331392-3b595880-7586-11ea-913c-ecbc7c7c0519.png) > > \*\*since Vers 3.2.3 "show top values"\*\* > show top values shows only: > > a) count > of a field value > > Now you need to create another widget (Pie chart) to get precentage > !\[grafik\](https://user-images.githubusercontent.com/46027642/78331460-5deb7180-7586-11ea-851d-18a94ad0cb85.png) > > It’s getting more complicated and the “percentage” values of field names are getting harder to see. > > A table view (message table) including “count” and “percentage” was perfect! Some one else was looking for the same thing here… > > > The way the "limit" option works within aggregations is not intuitive and produc…es strictly misleading outputs/visualisations. > > \## Expected Behavior > > Rows excluded from an aggregation using the limit option should be summed up into a single row named "other". This way, the relative percentages of each row always remain constant and accurate. > > > \## Current Behavior > At present, if I have a pie chart that would have 7 diferent "rows" in the legend, and I apply a limit of 5, I will get a pie chart that excludes the remaining 2 "rows" entirely from the results. > > > \## Context > > The limit option in Aggregations should \*\*not\*\* exclude results from the series. > > At present, if I have a pie chart that would have 7 diferent "rows" in the legend, and I apply a limit of 5, I will get a pie chart that excludes the remaining 2 "rows" entirely from the results. > > This distorts the ability of the output to correctly show relativity (eg. what % of events captured are from each row) and can make for very misleading results. > > For Example, does kernel represent 52.3% of results? or 41% of results? Or in fact, neither? > > !\[Screenshot 2021-12-08 at 10 28 25\](https://user-images.githubusercontent.com/85873295/145192665-31ba1a8c-ee2f-4852-84e1-3cecc2ed1d2a.png) > > !\[Screenshot 2021-12-08 at 10 28 08\](https://user-images.githubusercontent.com/85873295/145192675-c9a67e34-e0d0-4fbc-998c-ff6dd206987e.png) > > The way it should work in my view (this is the way it works on Splunk for example) is that rows excluded from the limit should be summed up into a single row named "other". This way, the relative percentages always remain constant and accurate. > > Why is the current way the limit function works a cardinal sin? > I think because the aggregation controls should \*\*not\*\* be able to affect which messages are encompassed by the aggregation visualisation - \*\*only\*\* the search filter should be able to define which results are encompassed. The aggregation controls should only be allowed to show how those results are displated. It's important to seperate powers in the interface this way so the user can understand where their results are coming from - by effectively having two seperate ways to filter out results, you make neither one definitive. > > > \## Your Environment > > \* Graylog Version: > 4.2.0 I believe they move most of what you are asking into a enterprise version with [Illuminate](https://www.graylog.org/products/illuminate) plugin. BTW its no longer called **Enterprise** version it is now called **Graylog Operations**. Only thing I can suggest at this point are: 1. Create two sparate Widegst , one for IPv4 and the other for IPv6 2. if your under 2 Gb a day the license is free for the Enterprise/Graylog Operations. version. 3. Last, Try working with [Grafana](https://www.fosslinux.com/8328/how-to-install-and-configure-grafana-on-centos-7.htm) it does have some nice dashboards for free but its a little more difficult. Here is what I was referring to > **[Pie chart](https://grafana.com/docs/grafana/latest/visualizations/pie-chart-panel/)** > > Pie chart The pie chart displays reduced series, or values in a series, from one or more queries, as they relate to each other, in the form of slices of … ---
**Author:** ![mosman](https://avatars.discourse-cdn.com/v4/letter/m/c6cbf5/32.png) [@mosman](https://community.graylog.org/u/mosman)\ **Post date:** [May 27, 2022, 4:02am UTC](https://community.graylog.org/t/too-dumb-to-create-pie-chart/24022/17 "2022-05-27T04:02:53Z")
Hello and thank you again. That confirms my “suspicion” a bit… Yes, I know of the thing “Quick Value” but they do not exist anymore, at least not that I see them. And yes, I did see the other posts and that did not help too… Creating two widgets is not a solution since I cannot get the ratio between V4 and V6 this way. I already tried to set up an explicit field (is\_ipv6) and the to count against that. However, I cannot get the full pie to represent the count of ALL messages and the pie content split between V4 and V6. Looks like I have to change my topic title 🙂 ---
**Author:** ![tmacgbay](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/tmacgbay/32/3878_2.png) [@tmacgbay](https://community.graylog.org/u/tmacgbay)\ **Post date:** [May 27, 2022, 2:38pm UTC](https://community.graylog.org/t/too-dumb-to-create-pie-chart/24022/18 "2022-05-27T14:38:36Z")
Have a separate field `ip_type` that contains either `IP_4` or `IP_6` Even your grandma can pie chart that! 😛 ---
**Author:** ![mosman](https://avatars.discourse-cdn.com/v4/letter/m/c6cbf5/32.png) [@mosman](https://community.graylog.org/u/mosman)\ **Post date:** [May 28, 2022, 1:58am UTC](https://community.graylog.org/t/too-dumb-to-create-pie-chart/24022/19 "2022-05-28T01:58:12Z")
Well, unfortunately I am no Grandma nor will I ever be one… But yes, that did the trick. Thank you a lot; sometimes you need that peek in the ribs to really get it. Cheers ---
**Author:** ![gsmith](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/gsmith/32/1222_2.png) [@gsmith](https://community.graylog.org/u/gsmith)\ **Post date:** [May 28, 2022, 2:27am UTC](https://community.graylog.org/t/too-dumb-to-create-pie-chart/24022/20 "2022-05-28T02:27:56Z")
Good call @tmacgbay , I’ve been banging my head trying to figure this out. I created a pipeline which is kinda crude for testing. ```auto rule " IP Type" when has_field ("nf_ipv4_dst_addr") && has_field ("nf_ipv4_src_addr") then set_field ( "ip_type", "IPV4"); end ``` Seams to work. ![image](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/2X/b/b421d23c4a6881a73c7f68acd9284e58f3cd8711.png) [Next page](https://community.graylog.org/t/too-dumb-to-create-pie-chart/24022.md?page=2)