Splunk Search

Pie chart displaying "other(n)" and "OTHER" fields.

Explorer

Hi,

I am creating a pie chart which shows the top logon count but unfortunatelly the system is showing two different types of "Others", one if "OTHER" and "other (n)".

This is my query:

... base search | top 10 User useother=true.

alt text

Does anyone know why this happening? It doesn't happen all the time, though. Sometimes only the "OTHER" value is present.

Thank you.

1 Solution

Super Champion

It is because the pie slices are two small that they put them together into other (2)
If you go into Format, you can change the slice size for when there are more than 10 slices (in your case there would be 11, with the useother argument for top 10). I tested changing some of my own data to .5 and that seemed to work.

View solution in original post

0 Karma

Super Champion

It is because the pie slices are two small that they put them together into other (2)
If you go into Format, you can change the slice size for when there are more than 10 slices (in your case there would be 11, with the useother argument for top 10). I tested changing some of my own data to .5 and that seemed to work.

View solution in original post

0 Karma

Explorer

Bingo! Thank you!

0 Karma

SplunkTrust
SplunkTrust

@cmerriman, the Minimum Size can be set to zero (0) as well to always show all slices.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

Path Finder

Hi Robettinger,

If use just - "top 10 User" one other record will go. "useother=true is creating new record.

I hope this will help you.

Explorer

Hi,

if I remove the "useother" both "Other" disappear and this would not reflect my use case. 😞 I would like to have only one other which accounts to the total number of remainning logons from other users.

0 Karma