<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic PIE CHART mouseover is displaying 100% value from nowhere? in Splunk Search</title>
    <link>https://community.splunk.com/t5/Splunk-Search/PIE-CHART-mouseover-is-displaying-100-value-from-nowhere/m-p/129716#M35295</link>
    <description>&lt;P&gt;My search:&lt;/P&gt;

&lt;UL&gt;
&lt;LI&gt;| chart max(REPORTING) as REPORTING max(MISSING) as MISSING&lt;/LI&gt;
&lt;/UL&gt;

&lt;P&gt;The table looks fine, 2 columns, REPORTING and MISSING, with value of 102 REPORTING and 4 MISSING.&lt;/P&gt;

&lt;P&gt;The pie chart looks like this:&lt;/P&gt;

&lt;P&gt;&lt;span class="lia-inline-image-display-wrapper" image-alt="alt text"&gt;&lt;img src="https://community.splunk.com/t5/image/serverpage/image-id/215iFAE17157D6D05E8A/image-size/large?v=v2&amp;amp;px=999" role="button" title="alt text" alt="alt text" /&gt;&lt;/span&gt;&lt;/P&gt;

&lt;P&gt;Where is 100% coming from?  How do I remove it?&lt;/P&gt;

&lt;P&gt;And if I add "| transpose" I get this chart with unwanted row/column text:&lt;/P&gt;

&lt;P&gt;&lt;span class="lia-inline-image-display-wrapper" image-alt="alt text"&gt;&lt;img src="https://community.splunk.com/t5/image/serverpage/image-id/216iF672DCA016742A64/image-size/large?v=v2&amp;amp;px=999" role="button" title="alt text" alt="alt text" /&gt;&lt;/span&gt;&lt;/P&gt;</description>
    <pubDate>Fri, 06 Feb 2015 23:33:24 GMT</pubDate>
    <dc:creator>the_wolverine</dc:creator>
    <dc:date>2015-02-06T23:33:24Z</dc:date>
    <item>
      <title>PIE CHART mouseover is displaying 100% value from nowhere?</title>
      <link>https://community.splunk.com/t5/Splunk-Search/PIE-CHART-mouseover-is-displaying-100-value-from-nowhere/m-p/129716#M35295</link>
      <description>&lt;P&gt;My search:&lt;/P&gt;

&lt;UL&gt;
&lt;LI&gt;| chart max(REPORTING) as REPORTING max(MISSING) as MISSING&lt;/LI&gt;
&lt;/UL&gt;

&lt;P&gt;The table looks fine, 2 columns, REPORTING and MISSING, with value of 102 REPORTING and 4 MISSING.&lt;/P&gt;

&lt;P&gt;The pie chart looks like this:&lt;/P&gt;

&lt;P&gt;&lt;span class="lia-inline-image-display-wrapper" image-alt="alt text"&gt;&lt;img src="https://community.splunk.com/t5/image/serverpage/image-id/215iFAE17157D6D05E8A/image-size/large?v=v2&amp;amp;px=999" role="button" title="alt text" alt="alt text" /&gt;&lt;/span&gt;&lt;/P&gt;

&lt;P&gt;Where is 100% coming from?  How do I remove it?&lt;/P&gt;

&lt;P&gt;And if I add "| transpose" I get this chart with unwanted row/column text:&lt;/P&gt;

&lt;P&gt;&lt;span class="lia-inline-image-display-wrapper" image-alt="alt text"&gt;&lt;img src="https://community.splunk.com/t5/image/serverpage/image-id/216iF672DCA016742A64/image-size/large?v=v2&amp;amp;px=999" role="button" title="alt text" alt="alt text" /&gt;&lt;/span&gt;&lt;/P&gt;</description>
      <pubDate>Fri, 06 Feb 2015 23:33:24 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Splunk-Search/PIE-CHART-mouseover-is-displaying-100-value-from-nowhere/m-p/129716#M35295</guid>
      <dc:creator>the_wolverine</dc:creator>
      <dc:date>2015-02-06T23:33:24Z</dc:date>
    </item>
    <item>
      <title>Re: PIE CHART mouseover is displaying 100% value from nowhere?</title>
      <link>https://community.splunk.com/t5/Splunk-Search/PIE-CHART-mouseover-is-displaying-100-value-from-nowhere/m-p/129717#M35296</link>
      <description>&lt;P&gt;&lt;span class="lia-inline-image-display-wrapper" image-alt="alt text"&gt;&lt;img src="https://community.splunk.com/t5/image/serverpage/image-id/214i7C9FA416923F4C49/image-size/large?v=v2&amp;amp;px=999" role="button" title="alt text" alt="alt text" /&gt;&lt;/span&gt;&lt;/P&gt;

&lt;P&gt;Workaround this by using transpose and rename the column and "row 1":&lt;/P&gt;

&lt;P&gt;| chart max(REPORTING) as&lt;BR /&gt;
"REPORTING" max(MISSING) as "MISSING" | transpose | rename "row 1" as count "column" as STATE&lt;/P&gt;</description>
      <pubDate>Fri, 06 Feb 2015 23:58:21 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Splunk-Search/PIE-CHART-mouseover-is-displaying-100-value-from-nowhere/m-p/129717#M35296</guid>
      <dc:creator>the_wolverine</dc:creator>
      <dc:date>2015-02-06T23:58:21Z</dc:date>
    </item>
  </channel>
</rss>

