topic Re: Issue in Pie chart, field is not showing? in Splunk Search

Why is field missing in piechart?

Shan — Thu, 23 Jun 2022 18:12:06 GMT

Hi All,

Need your support in resolving an issue in a pie chart. I can see the below-mentioned results in statistics and pie chat while running in a separate search window.

When adding the same pie chart to dashboard panel. Failed filed is missing in pie chart.

We have tried charting.chart.sliceCollapsingThreshold with 0 also. No luck.

While dashboard is loading we can able to see the field Failed. But not able see it after job completes.

Please provide you inputs. Thanks in Advance 🙂

Re: Issue in Pie chart, field is not showing?

Shan — Thu, 23 Jun 2022 07:31:31 GMT

Hi All,

Any idea..

Thanks..

Re: Why is field missing in piechart?

Shan — Mon, 27 Jun 2022 05:29:39 GMT

Hi All,

Any Suggestions..

Thanks..

Re: Why is field missing in piechart?

marysan — Mon, 27 Jun 2022 05:53:23 GMT

Hi
how many rows do your table have ? (6 rows ? or more ?)
please put a screen shot hear
(I think you must change Format visualization in your dashboard panel with replacing very smaller value)

Re: Why is field missing in piechart?

bowesmana — Mon, 27 Jun 2022 05:57:46 GMT

Odd... Do you only have 6 status slices? The collapsing setting only applies when there are more than 10 slices.

I cannot recreate the same - what version of Splunk are you using?

Re: Why is field missing in piechart?

jackdeng — Tue, 02 Apr 2024 04:25:58 GMT

I am encountering exactly the same issue - only 6 fields but one of them is collapsed.

Also tried charting.chart.sliceCollapsingThreshold = 0 - no luck

Re: Why is field missing in piechart?

KendallW — Tue, 02 Apr 2024 06:10:49 GMT

I have replicated the issue and here's what I have found

Only the top four values will be shown on the pie chart no matter how many fields are present in the table and no matter what value is used in Minimum Size / sliceCollapsingThreshold if there are:

six or more fields
at least one of them is significantly smaller than the largest number
the sum of all values is greater than 64,250

Test it yourself: Run this search and look what happens when you change the value of 'f' from 53138 to 53139

Could someone from Splunk please explain what is going on here, or add this to the known issues?

Re: Why is field missing in piechart?

bowesmana — Tue, 02 Apr 2024 22:47:48 GMT

It appears to be related to the size of the visualisation. I changed f to be 100003138 and still I see all 6 slices

but if I simply change the size of the visualisation area of the pie chart I will see this

Re: Why is field missing in piechart?

KendallW — Wed, 03 Apr 2024 00:01:44 GMT

That is so funny I never even thought of that 😄

@Shan could you confirm if @bowesmana's reply answers your question and accept it as the answer if so

Re: Why is field missing in piechart?

bowesmana — Wed, 03 Apr 2024 00:26:01 GMT

Nor did I when I answered 2 years ago 😁

Re: Why is field missing in piechart?

jackdeng — Wed, 03 Apr 2024 00:34:17 GMT

Thank you so much for the explanations - appreciate it!

it display all the fields now if I make the size of the piechart super large...

it still doesn't display all the fields if there are two piecharts side by side in the same row of a dashboard though, if the smallest percentage is too small. but it works well if it occupies an entire row.

Also to me this is still a bit un-intuitive for the users...

Re: Why is field missing in piechart?

bowesmana — Wed, 03 Apr 2024 00:35:42 GMT

Yes, that is very odd that it just removes fields if the viz space is not big enough and certainly not intuitive!