Pie Chart in XML Dashboard

[brent_weaver]

I am having issues getting my dashboard to show pie charts:

<dashboard>
  <label>Event Hub</label>
    <row>
     <panel>
      <title>Log Levels - Service - 24hr</title>
       <chart>
         <search>
           <query>sourcetype="eventhub:service" |chart count(_raw) as Events by lvl |rename lvl as "Log Level"</query>
           <earliest>-24h</earliest>
           <latest>now</latest>
           <option name="charting.chart">pie</option>
           <option name="charting.chart.showDataLabels">all</option>
           <option name="charting.layout.splitSeries">0</option>
         </search>
        </chart>
     </panel>
     <panel>
      <title>Log Levels - Kafka - 24hr</title>
       <chart>
         <search>
           <query>sourcetype="eventhub:kafka" |chart count(_raw) as Events by log_level |rename log_level as "Log Level"</query>
           <earliest>-24h</earliest>
           <latest>now</latest>
           <option name="charting.chart">pie</option>
           <option name="charting.chart.showDataLabels">all</option>
           <option name="charting.layout.splitSeries">0</option>
         </search>
        </chart>
     </panel>
     <panel>
      <title>Log Levels - Kafkai Controller - 24hr</title>
       <chart>
         <search>
           <query>sourcetype="eventhub:kafka:controller" |chart count(_raw) as Events by log_level |rename log_level as "Log Level"</query>
           <earliest>-24h</earliest>
           <latest>now</latest>
           <option name="charting.chart">pie</option>
           <option name="charting.chart.showDataLabels">all</option>
           <option name="charting.layout.splitSeries">0</option>
         </search>
        </chart>
     </panel>
     <panel>
      <title>Log Levels - Zookeeper - 24hr</title>
       <chart>
         <search>
           <query>sourcetype="eventhub:zookeeper" |chart count(_raw) as Events by log_level |rename log_level as "Log Level"</query>
           <earliest>-24h</earliest>
           <latest>now</latest>
           <option name="charting.chart">pie</option>
           <option name="charting.chart.showDataLabels">all</option>
           <option name="charting.layout.splitSeries">0</option>
         </search>
        </chart>
     </panel>
    </row>
</dashboard>

Everything works except the charts are col charts. Any help is much appreciated!

[brent_weaver]

THANK YOU ALL! After staring at this for another hour I figured the exact same thing out!

[niketn · Accepted solution]

@brent_weaver, you have placed Chart's Simple XML options inside the search tag. Please move <options> outside </search>

    <chart>
      <search>
        <query>sourcetype="eventhub:service" |chart count(_raw) as Events by lvl |rename lvl as "Log Level"</query>
        <earliest>-24h</earliest>
        <latest>now</latest>
      </search>
      <option name="charting.chart">pie</option>
      <option name="charting.chart.showDataLabels">all</option>
      <option name="charting.layout.splitSeries">0</option>
     </chart>

[cmerriman]

I think the problem might be with your options. showDataLabels and splitSeries are not options for pie charts. Try removing them to see if the pie chart shows. Add the labels with showLabel instead of use the UI formatting to ensure proper XML.

If you change the visualization in the UI does it work?

https://docs.splunk.com/Documentation/Splunk/latest/Viz/ChartConfigurationReference