All Apps and Add-ons

collapsing threshold in donut chart

splunkdivya
Explorer

Hi Splunkers,

I have a use case where in I am plotting count against users with donut. Now, the issue is: for values < 99%, we get an "OTHER" slice. I need the complete dataset, no "other" slice. tried collapsing threshold with the visualisation, even limit=0 does not work for me. Any pointers would be highly appreciated.

Best,

0 Karma

chuckf
New Member

Adjust the formatting of the visualization in version 1.0.3 (or higher) which was recently uploaded to Splunkbase. For the “Use Min Percent” setting change it from Yes to No. This will disable the Min Percent setting and display all of the results from the search as slices in the Donut visualization. Depending on the data, this may result in a very noisy visualization.

Another method, which doesn't sound like it would be an option in this particular case but others may find useful, is to use the ‘top’ search function as a part of the original search. If your search is, for instance, "index=main | chart count(source) by source”, consider changing it to "index=main | chart count(source) by source|top limit=12 source”. The latter search will only display the top 12 results in the search and eliminate the OTHER slice from appearing. The limit setting must be at least 1 less than the amount of results that causes the OTHER slice to appear, so it may take some adjusting to get the OTHER slice not to appear. This will mean that you do not see the results of the lowest number of results from your search reflected in any way in the visualization, but will potentially be less noisy than eliminating the min percent setting.

Hope this helps.

0 Karma

splunker12er
Motivator

you can remove the "OTHER" from the results with "useother=f",

e,g.

| timechart span=1d sum(field_1) AS sum_field_1 by field_2 useother=f fixedrange=false

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Can’t Make It to Boston? Stream .conf25 and Learn with Haya Husain

Boston may be buzzing this September with Splunk University and .conf25, but you don’t have to pack a bag to ...

Splunk Lantern’s Guide to The Most Popular .conf25 Sessions

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Unlock What’s Next: The Splunk Cloud Platform at .conf25

In just a few days, Boston will be buzzing as the Splunk team and thousands of community members come together ...