topic Re: Help showing top tenants by number of hosts in pie chart in Splunk Search

Help showing top tenants by number of hosts in pie chart

marcorivera — Tue, 10 May 2022 14:16:37 GMT

I would like to make a pie chart which shows the Top 10 tenants by number of hosts and then put everything else under the label "other".

Currently, I am doing this:

| stats sum(hostsCount) as hostsCount by TenantName
| sort hostsCount desc

The issue with this is that it truncates the TenantNames to 10000 as shown in the screenshot which makes the "other" category's hostsCount not accurate. There are over 30000 TenantNames/hostsCount.

I would like to change this Pie chart to:

1. Display the Top 10 tenants by hostsCount

2. Make a label called "other" and put all the remaining hostsCounts in them so that it displays the accurate percentage/amount.

What would be the best way to do this?

Re: Help showing top tenants by number of hosts in pie chart

venky1544 — Tue, 10 May 2022 14:38:06 GMT

Hi @marcorivera

just try

your search | top limit=10 useother=true hostsCount

if it helps karma points are appreciated /if it resolves solution acceptance is appreciated

Re: Help showing top tenants by number of hosts in pie chart

marcorivera — Tue, 10 May 2022 14:59:39 GMT

@venky1544 Sorry, I'm new to Splunk.. when I tried putting the "| top limit=10..." command at the bottom, it did not work and resulted into this. Am I doing it incorrectly?

Re: Help showing top tenants by number of hosts in pie chart

venky1544 — Wed, 11 May 2022 09:40:34 GMT

hi @marcorivera

apologies i read the question wrong you can ignore the top command

your earlier query is correct

If you save the piechart in a dashboard, and then you can use the charting.data.count option to set a higher limit (even unlimited (0)).

https://docs.splunk.com/Documentation/SplunkCloud/8.2.2202/Viz/ChartConfigurationReference

P.S if it helps karma points are appreciated