Dashboards & Visualizations

Pie Charts in splunk

DTERM
Contributor

I have the following code that creates a pie chart in a form.

  <row>
<chart>
  <title>Customer Activity</title>
  <option name="charting.chart">pie</option>
  <option name="drilldown">all</option>
</chart>
<chart>
  <title>Customer Activity</title>
  <option name="drilldown">all</option>
</chart>

The pie chart is displaying dates values in the pie chart versus customer names. Is there a way to change the contents of the pie chart to display customer information (names) and not dates?

Thanks.

Tags (1)
0 Karma
1 Solution

_d_
Splunk Employee
Splunk Employee

DTERM,

If you change your timechart to chart you should see the results that you expect.

i.e. change your search from this:

index="myapp" sourcetype="cag_sla" customer != "" show!="" | timechart count by customer

to this:
index="myapp" sourcetype="cag_sla" customer != "" show!="" | chart count by customer

--

> please upvote and accept answer if you find it useful - thanks!

View solution in original post

_d_
Splunk Employee
Splunk Employee

DTERM,

If you change your timechart to chart you should see the results that you expect.

i.e. change your search from this:

index="myapp" sourcetype="cag_sla" customer != "" show!="" | timechart count by customer

to this:
index="myapp" sourcetype="cag_sla" customer != "" show!="" | chart count by customer

--

> please upvote and accept answer if you find it useful - thanks!

AlexMcDuffMille
Communicator

When do pie charts collapse values into "other" (see sliceCollapsingThreshold)

0 Karma

AlexMcDuffMille
Communicator

Is there a way to limit the number of results that show up in the pie chart and have them go in the 'other' category?

Rather than 20 results and 1 other, is there a way to just have 10 results and 1 other (making the 'other' piece larger)?

0 Karma

_d_
Splunk Employee
Splunk Employee

DTERM, please accept this as an answer so that other community members can benefit from it,too. Happy Splunking!

0 Karma

DTERM
Contributor

That did it. Thanks much!!

DTERM
Contributor

Here is the complete form, again, the question is how to change the pie chart below to display customer names, versus dates. Thanks in advance.

index="myapp" sourcetype="cag_sla" customer != "" show!="" | timechart count by customer
Last 7 days>
Customer Activity Most Active pie all Customer Activity Most Active all Customer Activity Most Active all
0 Karma

Dark_Ichigo
Builder

You have to change your search to return names as the field your pie chart is grouped on, or the way you group your fields in your search that way you can view your pie chart by Names, Post your search it will help us understand your problem more.

0 Karma

_d_
Splunk Employee
Splunk Employee

DTerm, What does your search look like?

0 Karma
Get Updates on the Splunk Community!

Splunk Education - Fast Start Program!

Welcome to Splunk Education! Splunk training programs are designed to enable you to get started quickly and ...

Five Subtly Different Ways of Adding Manual Instrumentation in Java

You can find the code of this example on GitHub here. Please feel free to star the repository to keep in ...

New Splunk APM Enhancements Help Troubleshoot Your MySQL and NoSQL Databases Faster

Splunk Observability has two new enhancements to make it quicker and easier to troubleshoot slow or frequently ...