Dashboards & Visualizations

Pie Charts in splunk

DTERM
Contributor

I have the following code that creates a pie chart in a form.

  <row>
<chart>
  <title>Customer Activity</title>
  <option name="charting.chart">pie</option>
  <option name="drilldown">all</option>
</chart>
<chart>
  <title>Customer Activity</title>
  <option name="drilldown">all</option>
</chart>

The pie chart is displaying dates values in the pie chart versus customer names. Is there a way to change the contents of the pie chart to display customer information (names) and not dates?

Thanks.

Tags (1)
0 Karma
1 Solution

_d_
Splunk Employee
Splunk Employee

DTERM,

If you change your timechart to chart you should see the results that you expect.

i.e. change your search from this:

index="myapp" sourcetype="cag_sla" customer != "" show!="" | timechart count by customer

to this:
index="myapp" sourcetype="cag_sla" customer != "" show!="" | chart count by customer

--

> please upvote and accept answer if you find it useful - thanks!

View solution in original post

_d_
Splunk Employee
Splunk Employee

DTERM,

If you change your timechart to chart you should see the results that you expect.

i.e. change your search from this:

index="myapp" sourcetype="cag_sla" customer != "" show!="" | timechart count by customer

to this:
index="myapp" sourcetype="cag_sla" customer != "" show!="" | chart count by customer

--

> please upvote and accept answer if you find it useful - thanks!

AlexMcDuffMille
Communicator

When do pie charts collapse values into "other" (see sliceCollapsingThreshold)

0 Karma

AlexMcDuffMille
Communicator

Is there a way to limit the number of results that show up in the pie chart and have them go in the 'other' category?

Rather than 20 results and 1 other, is there a way to just have 10 results and 1 other (making the 'other' piece larger)?

0 Karma

_d_
Splunk Employee
Splunk Employee

DTERM, please accept this as an answer so that other community members can benefit from it,too. Happy Splunking!

0 Karma

DTERM
Contributor

That did it. Thanks much!!

DTERM
Contributor

Here is the complete form, again, the question is how to change the pie chart below to display customer names, versus dates. Thanks in advance.

index="myapp" sourcetype="cag_sla" customer != "" show!="" | timechart count by customer
Last 7 days>
Customer Activity Most Active pie all Customer Activity Most Active all Customer Activity Most Active all
0 Karma

Dark_Ichigo
Builder

You have to change your search to return names as the field your pie chart is grouped on, or the way you group your fields in your search that way you can view your pie chart by Names, Post your search it will help us understand your problem more.

0 Karma

_d_
Splunk Employee
Splunk Employee

DTerm, What does your search look like?

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...