Dashboards & Visualizations
Highlighted

Pie Charts in splunk

Contributor

I have the following code that creates a pie chart in a form.

  <row>
<chart>
  <title>Customer Activity</title>
  <option name="charting.chart">pie</option>
  <option name="drilldown">all</option>
</chart>
<chart>
  <title>Customer Activity</title>
  <option name="drilldown">all</option>
</chart>

The pie chart is displaying dates values in the pie chart versus customer names. Is there a way to change the contents of the pie chart to display customer information (names) and not dates?

Thanks.

Tags (1)
0 Karma
Highlighted

Re: Pie Charts in splunk

Splunk Employee
Splunk Employee

DTerm, What does your search look like?

0 Karma
Highlighted

Re: Pie Charts in splunk

Builder

You have to change your search to return names as the field your pie chart is grouped on, or the way you group your fields in your search that way you can view your pie chart by Names, Post your search it will help us understand your problem more.

0 Karma
Highlighted

Re: Pie Charts in splunk

Contributor

Here is the complete form, again, the question is how to change the pie chart below to display customer names, versus dates. Thanks in advance.

index="myapp" sourcetype="cag_sla" customer != "" show!="" | timechart count by customer
Last 7 days>
Customer Activity Most Active pie all Customer Activity Most Active all Customer Activity Most Active all
0 Karma
Highlighted

Re: Pie Charts in splunk

Splunk Employee
Splunk Employee

DTERM,

If you change your timechart to chart you should see the results that you expect.

i.e. change your search from this:

index="myapp" sourcetype="cag_sla" customer != "" show!="" | timechart count by customer

to this:
index="myapp" sourcetype="cag_sla" customer != "" show!="" | chart count by customer

--

> please upvote and accept answer if you find it useful - thanks!

View solution in original post

Highlighted

Re: Pie Charts in splunk

Contributor

That did it. Thanks much!!

Highlighted

Re: Pie Charts in splunk

Splunk Employee
Splunk Employee

DTERM, please accept this as an answer so that other community members can benefit from it,too. Happy Splunking!

0 Karma
Highlighted

Re: Pie Charts in splunk

Communicator

Is there a way to limit the number of results that show up in the pie chart and have them go in the 'other' category?

Rather than 20 results and 1 other, is there a way to just have 10 results and 1 other (making the 'other' piece larger)?

0 Karma
Highlighted

Re: Pie Charts in splunk

Communicator

When do pie charts collapse values into "other" (see sliceCollapsingThreshold)

0 Karma