topic Re: chart over refuses to show OTHER group in Dashboards & Visualizations

chart over refuses to show OTHER group

yuanliu — Tue, 08 Aug 2017 21:10:17 GMT

Many people asked about how to suppress OTHER group from charts. But I have the opposite problem: When I use chart blah over foo by bar, legends include an "OTHER" group but the chart does not show it. This results in seriously skewed charts. For example, when I do not specify limit (default 10), I get three blank bands out of 6. (Only one blank expected.); if I do limit=20, I get two blank bands. Now if I do limit=30, five bands have non-zero values, but they are not correct judging by setting limit=40 and limit=0. Now I can't even trust limit=0 because OTHER group still exist. How can I force OTHER to display?

Re: chart over refuses to show OTHER group

martin_mueller — Wed, 09 Aug 2017 09:39:20 GMT

I tried to reproduce that using this search:

index=_internal sourcetype=splunkd_access | chart count over file by bytes

However, I get a chart with all columns containing something, lots with OTHER.

What version are you on?
Can you reproduce your issue using splunk-internal data to run anywhere?

Re: chart over refuses to show OTHER group

woodcock — Wed, 09 Aug 2017 11:44:26 GMT

The chart command has a useother argument that you can try setting as useother=t.

Re: chart over refuses to show OTHER group

yuanliu — Wed, 09 Aug 2017 19:10:32 GMT

Version is 6.6.2. I tried several combinations with index=_internal but they are all able to show OTHER on chart. (Which is what I have always expected unless I specify useother=false).

But this inspired me to examine the stats in more detail, and discover that OTHER group alone contains multivalue entries! Because my input is single value, I was foolish to believe that values() is as good as any other function, not realising that OTHER would wreck havoc. Many thanks!

Re: chart over refuses to show OTHER group

yuanliu — Wed, 09 Aug 2017 19:14:19 GMT

@martin_mueller is my usual muse:-). The problem is caused by my mistaken belief that values() on single-value input will always result in single-value stats. It does, except with charting where a group of stats have to be combined into OTHER, causing this group to be multi-valued and not displayed on the chart.