Splunk Search

Pie Chart is not showing smaller values

harshal_chakran
Builder

Hi ,
I have a CSV file, whose visualization I want to see in the form of Pie-Chart.
But on display, one of the parameter is not shown. I am guessing the Pie-chart is hiding it because of its small value.
Below is my CSV file:

PARAMETER  VALUE
ASDF         6
XCV      34
ERT      1
TDED        14
GHT      3
GHB      2
BNHJ        17
QWE     17
DDD      9
YYY      8
KLO      7
POL      2
YUO     82
TRYU         2

The Pie chart hides parameter "ERT" with value "1". while remaining ones are properly displayed.
What change I have to do to display every single value in Pie-Chart, even if its very small.
I have added this line in XML too:

charting.chart.sliceCollapsingThreshold = 0

, It removed the "others()" tag but didn't solved the issue

Please Help...!!!

0 Karma

yuanliu
SplunkTrust
SplunkTrust

Screenshot 2025-03-05 at 8.45.30 PM.png

Not sure what you see, but this works in my instance.

Data emulation is

| makeresults
| eval _raw = "PARAMETER  VALUE
ASDF         6
XCV      34
ERT      1
TDED        14
GHT      3
GHB      2
BNHJ        17
QWE     17
DDD      9
YYY      8
KLO      7
POL      2
YUO     82
TRYU         2"
| multikv
| fields - _* linecount

jasonwagner
Explorer

Yes, in your screenshot example it works because your pie chart is large.  Reduce the size of the pie chart and you'll notice how fields start to disappear.  This is even more apparent when one or multiple fields are much larger values than all of the others.  This happens to me even if you change the "Minimum Size" = 0.

jasonwagner_0-1741387841871.png

 

0 Karma

yuanliu
SplunkTrust
SplunkTrust

Do you mean to say pie chart is not showing labels on smaller slices?  This is what I get when I really press down both graph size and smallest slice. (0.41% is currently the smallest.)  Yes, outward labels for smaller slices have disappeared.  But each slice is still present; if I mouse over them, their individual labels, values, and shares still show (second screenshot)  This seems to be a sensible use of real estate.  Then, if you have many especially small slices, there will be a limitation as to whether your mouse cursor could land on a given slice.

Screenshot 2025-03-08 at 12.45.11 PM.png

Screenshot 2025-03-08 at 12.45.44 PM.png

This is my new emulation

| makeresults
| eval _raw = "PARAMETER  VALUE
ASDF         6
XCV      34
ERT      1
TDED        14
GHT      3
GHB      2
BNHJ        57
QWE     17
DDD      9
YYY      8
KLO      7
POL      2
YUO     82
TRYU         2"
| multikv
| fields - _* linecount
| sort VALUE

 

0 Karma

venkatesh296
Explorer

Hi,
Increase the size of the chart by
< option name="height">450px then you will see.

Thanks

jasonwagner
Explorer

This worked for me.  My pie chart was just one of a few panels in a dashboard's row.  When I would open that panel search on its own, even fields with small values would be shown because it was a pie chart in its own "row".  Moving my pie chart into its own dashboard row and making it larger then showed small values in the visualization.  Sadly, I have not found any other changes to the visualization settings, search parameters/settings, that would force a small pie chart to show all fields that have small values.  Quite annoying.

0 Karma

NOUMSSI
Builder

Hi,

At the end of your query add this:

your_statistical_query|SHOWOTHER=f
0 Karma

venkatesh296
Explorer

Hi Noumssi,
It didn't worked. Please help anyone.

Thanks

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Can’t Make It to Boston? Stream .conf25 and Learn with Haya Husain

Boston may be buzzing this September with Splunk University and .conf25, but you don’t have to pack a bag to ...

Splunk Lantern’s Guide to The Most Popular .conf25 Sessions

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Unlock What’s Next: The Splunk Cloud Platform at .conf25

In just a few days, Boston will be buzzing as the Splunk team and thousands of community members come together ...