topic Re: Removing "Others" result from chart in advanced XML in Splunk Search

Removing "Others" result from chart in advanced XML

responsys_cm — Tue, 21 Aug 2012 09:05:47 GMT

I have a chart that is fed results from a search ending in | top limit=10 dest_ip. The chart in the dashboard always renders with the "Others" field that sums the results of all rows that didn't make the top ten.

How can I disable this? The userother=false doesn't disable it...

Thx.

Craig

Re: Removing "Others" result from chart in advanced XML

Ayn — Tue, 21 Aug 2012 09:25:06 GMT

Really? That's what useother should be doing. Are you sure you specified it correctly (useother, not userother)?

Re: Removing "Others" result from chart in advanced XML

MHibbin — Tue, 21 Aug 2012 11:56:33 GMT

Hi,

Have you verified you "Other" field is not just the sum the remaining "top 10" entries which are not displayed in your chart.

You should also look at the chart's properties (http://docs.splunk.com/Documentation/Splunk/4.3.3/Developer/CustomChartingConfig-chartlegend).

I've had similar issues with "Other", where there may be a hugh difference between the 1st (top) item and subsequent items, as the visual slice would be "too small" to see. For this in my advanced XML under the chart module I would add something like the following...

<param name="charting.chart.sliceCollapsingThreshold">0</param>

This will disable the threshold, and stop the collapsing of results into "other".

For reference check the registered modules by visiting ... http://splunkServer:8000/en-GB/modules#Splunk.Module.HiddenChartFormatter

Re: Removing "Others" result from chart in advanced XML

sideview — Tue, 21 Aug 2012 17:02:12 GMT

Right. pie charts have their own "Other" which shows up. Because chart and timechart put out an "OTHER", it's easy to see this and assume it's a search language thing. Charting keys can take it away like you see here. Of ccurse then the pie chart becomes extremely misleading! and in which case you probably shouldn't be using a pie chart.