Dashboards & Visualizations

How to display an "other" bar in a bar chart?

pgoldweic
Communicator

I'd like to display up to a certain number of data points in a bar chart in a way that the rest of the items which do *not* get displayed are collapsed into one bar: "other". Is there a way to do this? I'm aware that I can simply set the maximum number of data points to display, but this provides no information about the rest, which is what I'm trying to do.  I'm using the Splunjs framework to create the visualization in an app external to Splunk. 

Labels (1)
Tags (1)
0 Karma
1 Solution

ITWhisperer
Legend
-- your seaarch
| sort - countfield
| eventstats sum(countfield) as total
| head 8
| eventstats sum(countfield) as partial 
| sort countfield
| streamstats count as row
| eval row=if(row = 1, mvappend(row,"0"), row)
| mvexpand row
| eval dimension=if(row = 0, "Other", dimension)
| eval countfield=if(row = 0, total - partial, countfield)
| sort - row
| fields - row partial total

View solution in original post

0 Karma

pgoldweic
Communicator

Thanks for your reply! It looks like I've deleted my original response to this post by mistake :-(.  I understand this as a clever work-around for the fact that the feature is not supported (as built-in) in bar charts. I am not familiar yet with some of the commands in your query, but I'll them up as they seem pretty useful. Thanks!

0 Karma

ITWhisperer
Legend
-- your seaarch
| sort - countfield
| eventstats sum(countfield) as total
| head 8
| eventstats sum(countfield) as partial 
| sort countfield
| streamstats count as row
| eval row=if(row = 1, mvappend(row,"0"), row)
| mvexpand row
| eval dimension=if(row = 0, "Other", dimension)
| eval countfield=if(row = 0, total - partial, countfield)
| sort - row
| fields - row partial total

View solution in original post

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!