Answer by warren for How to make pie chart of these values in Splunk

Since you seem to be concerned only about whether "found" equals either "hit" or "miss", try this:

index=app (splunk_server_group=bex OR splunk_server_group=default) sourcetype=rpm-web* host=rpm-web* "CACHE_NAME=RATE_SHOPPER" method=GET found IN("hit","miss")
| stats count by found

from User warren – Stack Overflow https://stackoverflow.com/questions/71836567/how-to-make-pie-chart-of-these-values-in-splunk/71844522#71844522
via IFTTT