Creating a pie chart

Use a pie chart to represent numbers in percentages, or to visualize the parts of a relationship or a composition.

1. In the Views section of the widget, give the chart a name and select whether to show the title and the update status.
2. Select Pie Chart.
3. On the General tab, select a label and value.
4. For offense data sources only, click More options, and select an aggregation type for the value. The following list describes the available aggregation options:

   Option	Description
   No aggregation	If the field is numerical, returns the sum of each unique label.
   First	For each unique label, returns the first value of the selected field.
   Average	For each unique label, returns the average of the selected field.
   Sum	For each unique label, returns the sum of each value of the selected field.
   Count	For each unique label, returns a row count of the selected field.
   Maximum	For each unique label, returns the largest numeric value of the selected field.
   Minimum	For each unique label, returns the smallest numeric value of the selected field.

5. Set Doughnut Chart to On to give the chart an open center.
6. Set Show Legend to Yes and set the orientation.
7. On the Format tab, select a text format and hover format for the labels.
8. Optional: On the Drilldown tab, choose a drill down action for when a slice is clicked in the pie chart. You can open a dashboard, a URL, or a specific page in the source application (IBM QRadar or QRadar Analyst Workflow).
   1. If you chose to open a dashboard, select the dashboard to open, optionally select dashboard parameter values, and choose whether to open it in the current window or in a new window.

      If you set parameters, they are passed to the target dashboard based on the slice that was clicked in the pie chart. For example, if you set an ID parameter, the bar or segment ID is passed as a parameter to the target dashboard. If you set a dashboard parameter value to Default, no parameter value is passed to the target dashboard; the existing session or default parameter value is used or the parameter field is blank in the target dashboard Parameters card.

      Tip: If you drill down to a different dashboard in the same window, you can use the breadcrumb trail to return to previous dashboards in the drill path.
   2. If you chose to open a URL, specify an absolute path to open an external URL (for example, https://www.ibm.com) or a relative path to open a QRadar page, such as DNS lookup. The URL opens in a new browser window.

      You can define any number of parameters anywhere in the URL. Enclose parameters in braces ({}), then select a value for each parameter.

      The following table lists some typical QRadar URLs with parameters:

      Description	URL
      QRadar port scan The data source must include source or destination IP addresses. The {ip_address} string defines an ip_address URL parameter for a source or destination IP address column. Then, when you drill down on a table row, the port scan page opens to the source or destination IP address of the row.	/console/core/jsp/investigate.jsp?type=port_scan&host={ip_address}
      QRadar DNS lookup The data source must include source or destination IP addresses. The {ip_address} string defines an ip_address URL parameter for a source or destination IP address column. Then, when you drill down on a table row, the DNS lookup page opens to the source or destination IP address of the row.	/console/core/jsp/investigate.jsp?type=dns_lookup&host={ip_address}
      QRadar WHOIS lookup The data source must include source or destination IP addresses. The {ip_address} string defines an ip_address URL parameter for a source or destination IP address column. Then, when you drill down on a table row, the WHOIS lookup page opens to the source or destination IP address of the row.	/console/core/jsp/investigate.jsp?type=whois_lookup&host={ip_address}
      QRadar Offense Summary page The data source must include offense IDs. The {offense_id} string defines an offense_id URL parameter for an ID column. Then, when you drill down on a table row, the Offense Summary page opens to the offense ID of the row.	/console/do/sem/offensesummary?appName=Sem&pageId=OffenseSummary&summaryId={offense_id}

9. Preview how the chart looks and then click Save.
   Tip: The labels for the chart come from the queries that are used. If they are unintelligible in the preview, edit the labels in the View section.