topic Re: Pie chart show 0 results in Dashboards & Visualizations

Pie chart show 0 results

mcohen13 — Tue, 29 Sep 2020 19:52:39 GMT

i have in issue with my pie chart
query:
index="customer_summary_info" | chart sum(event_category_*) | transpose

my pie show also the 0 results in the pie which is confusing
tried cont=false but it's not working

Re: Pie chart show 0 results

DalJeanis — Mon, 11 Jun 2018 14:16:18 GMT

Here's a trick to how to think about splunk... chart is a presentation command. When you are having trouble making it do what you want, then back up and do the calculation with stats, then present the data after you are done with the statistical manipulation.

In this case, chart is taking you the wrong direction. You immediately transposed the result, meaning you didn't want it presented sideways anyway.

index="customer_summary_info"
| fields event_category_*
| stats sum(event_category_*) as cat_* by index

Now you have a single record with all your event categories summarized.... pretty much the same as chart gave you. To get rid of categories with zero results, there's a trick with untable. (That's why I left another field in there, index, although it might as well have been called dummy)

| untable index Category Sum
| where Sum>0
| fields - index

You now have one record per non-zero Category, with "cat_*" in the field named Category, and the sum in the field named Sum. This should provide what you need for your pie chart.

Re: Pie chart show 0 results

mcohen13 — Tue, 29 Sep 2020 19:53:05 GMT

Re: Pie chart show 0 results

mcohen13 — Mon, 11 Jun 2018 15:43:20 GMT

removed the "by Dummy" and now it works
thanks 🙂