Splunk Search

Pie chart displaying "other(n)" and "OTHER" fields.

robettinger
Explorer

Hi,

I am creating a pie chart which shows the top logon count but unfortunatelly the system is showing two different types of "Others", one if "OTHER" and "other (n)".

This is my query:

... base search | top 10 User useother=true.

alt text

Does anyone know why this happening? It doesn't happen all the time, though. Sometimes only the "OTHER" value is present.

Thank you.

1 Solution

cmerriman
Super Champion

It is because the pie slices are two small that they put them together into other (2)
If you go into Format, you can change the slice size for when there are more than 10 slices (in your case there would be 11, with the useother argument for top 10). I tested changing some of my own data to .5 and that seemed to work.

View solution in original post

0 Karma

cmerriman
Super Champion

It is because the pie slices are two small that they put them together into other (2)
If you go into Format, you can change the slice size for when there are more than 10 slices (in your case there would be 11, with the useother argument for top 10). I tested changing some of my own data to .5 and that seemed to work.

0 Karma

robettinger
Explorer

Bingo! Thank you!

0 Karma

niketn
Legend

@cmerriman, the Minimum Size can be set to zero (0) as well to always show all slices.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

ab81428
Path Finder

Hi Robettinger,

If use just - "top 10 User" one other record will go. "useother=true is creating new record.

I hope this will help you.

robettinger
Explorer

Hi,

if I remove the "useother" both "Other" disappear and this would not reflect my use case. 😞 I would like to have only one other which accounts to the total number of remainning logons from other users.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...