Dashboards & Visualizations

Pie Chart in XML Dashboard

brent_weaver
Builder

I am having issues getting my dashboard to show pie charts:

<dashboard>
  <label>Event Hub</label>
    <row>
     <panel>
      <title>Log Levels - Service - 24hr</title>
       <chart>
         <search>
           <query>sourcetype="eventhub:service" |chart count(_raw) as Events by lvl |rename lvl as "Log Level"</query>
           <earliest>-24h</earliest>
           <latest>now</latest>
           <option name="charting.chart">pie</option>
           <option name="charting.chart.showDataLabels">all</option>
           <option name="charting.layout.splitSeries">0</option>
         </search>
        </chart>
     </panel>
     <panel>
      <title>Log Levels - Kafka - 24hr</title>
       <chart>
         <search>
           <query>sourcetype="eventhub:kafka" |chart count(_raw) as Events by log_level |rename log_level as "Log Level"</query>
           <earliest>-24h</earliest>
           <latest>now</latest>
           <option name="charting.chart">pie</option>
           <option name="charting.chart.showDataLabels">all</option>
           <option name="charting.layout.splitSeries">0</option>
         </search>
        </chart>
     </panel>
     <panel>
      <title>Log Levels - Kafkai Controller - 24hr</title>
       <chart>
         <search>
           <query>sourcetype="eventhub:kafka:controller" |chart count(_raw) as Events by log_level |rename log_level as "Log Level"</query>
           <earliest>-24h</earliest>
           <latest>now</latest>
           <option name="charting.chart">pie</option>
           <option name="charting.chart.showDataLabels">all</option>
           <option name="charting.layout.splitSeries">0</option>
         </search>
        </chart>
     </panel>
     <panel>
      <title>Log Levels - Zookeeper - 24hr</title>
       <chart>
         <search>
           <query>sourcetype="eventhub:zookeeper" |chart count(_raw) as Events by log_level |rename log_level as "Log Level"</query>
           <earliest>-24h</earliest>
           <latest>now</latest>
           <option name="charting.chart">pie</option>
           <option name="charting.chart.showDataLabels">all</option>
           <option name="charting.layout.splitSeries">0</option>
         </search>
        </chart>
     </panel>
    </row>
</dashboard>

Everything works except the charts are col charts. Any help is much appreciated!

Tags (1)
0 Karma
1 Solution

niketn
Legend

@brent_weaver, you have placed Chart's Simple XML options inside the search tag. Please move <options> outside </search>

    <chart>
      <search>
        <query>sourcetype="eventhub:service" |chart count(_raw) as Events by lvl |rename lvl as "Log Level"</query>
        <earliest>-24h</earliest>
        <latest>now</latest>
      </search>
      <option name="charting.chart">pie</option>
      <option name="charting.chart.showDataLabels">all</option>
      <option name="charting.layout.splitSeries">0</option>
     </chart>
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

0 Karma

brent_weaver
Builder

THANK YOU ALL! After staring at this for another hour I figured the exact same thing out!

0 Karma

niketn
Legend

@brent_weaver, you have placed Chart's Simple XML options inside the search tag. Please move <options> outside </search>

    <chart>
      <search>
        <query>sourcetype="eventhub:service" |chart count(_raw) as Events by lvl |rename lvl as "Log Level"</query>
        <earliest>-24h</earliest>
        <latest>now</latest>
      </search>
      <option name="charting.chart">pie</option>
      <option name="charting.chart.showDataLabels">all</option>
      <option name="charting.layout.splitSeries">0</option>
     </chart>
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

cmerriman
Super Champion

I think the problem might be with your options. showDataLabels and splitSeries are not options for pie charts. Try removing them to see if the pie chart shows. Add the labels with showLabel instead of use the UI formatting to ensure proper XML.

If you change the visualization in the UI does it work?

https://docs.splunk.com/Documentation/Splunk/latest/Viz/ChartConfigurationReference

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...