Splunk Search

Pie chart labels blank (except "Other")

FunPolice
Path Finder

I have some pie charts on a dashboard:

<dashboard>
  <label>Mail Gateway Summary</label>
  <row>`
    <chart>
      <searchName>Mail Gateway - Events by Sender (Chart)</searchName>
      <title>Events by Sender</title>
      <option name="charting.chart">pie</option>
      <option name="charting.chart.showlabels">true</option>
    </chart>
    <chart>
      <searchName>OSS Mail Gateway - Events by Recipient (Chart)</searchName>
      <title>Events by Recipient</title>
      <option name="charting.chart">pie</option>
      <option name="charting.chart.showlabels">true</option>
      <option name="charting.chart.showpercent">true</option>
    </chart>
  </row>

and so on.

The searches are of the form:

[Mail Gateway - Events by Recipient (Chart)]
action.email.inline = 1
alert.digest_mode = True
alert.suppress = 0
alert.track = 0
dispatch.earliest_time = -2d
displayview = report_builder_display
request.ui_dispatch_view = report_builder_display
search = index="mcafee_mail" sourcetype="mcafee_toaster" Application="smtp" | stats count by to | sort -count

and they work fine, however the segment labels are not displayed on the pie chart (only the "other" label appears). The leaders are displayed for every segment label. Is there a limit to the length of a label? The labels should be e-mail addresses, and are mostly at least 20 characters long.

Tags (2)
0 Karma

Simon_Fishel
Splunk Employee
Splunk Employee

There is no limit on the length of the labels...

First off - though I doubt this is the source of your problem - the charting option tags should look like this (note the camel case in the option names):

<option name="charting.chart.showLabels">true</option>
<option name="charting.chart.showPercent">true<option>

And actually showLabels defaults to true for pie charts so you can leave that out if you want.

Can you post a screen shot of one of these charts? It would also be helpful if you could post the search results in table form, either by running one of the searches in the timeline page or by adding a table to your dashboard.

Lastly, what do you see when you hover over one of the slices? Does the tooltip have the right label or is it also blank?

psneathen
New Member

Perfect. This worked great for me. Thank you.

0 Karma

FunPolice
Path Finder

I've been sidetracked on this one, sorry - I'll get some screen shots up as soon as I can. The "From" field is blank in the tooltip as well.

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Thanks for the Memories! Splunk University, .conf25, and our Community

Thank you to everyone in the Splunk Community who joined us for .conf25, which kicked off with our iconic ...

Data Persistence in the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. What happens if the OpenTelemetry collector ...

Introducing Splunk 10.0: Smarter, Faster, and More Powerful Than Ever

Now On Demand Whether you're managing complex deployments or looking to future-proof your data ...