Splunk Search

Pie chart labels blank (except "Other")

FunPolice
Path Finder

I have some pie charts on a dashboard:

<dashboard>
  <label>Mail Gateway Summary</label>
  <row>`
    <chart>
      <searchName>Mail Gateway - Events by Sender (Chart)</searchName>
      <title>Events by Sender</title>
      <option name="charting.chart">pie</option>
      <option name="charting.chart.showlabels">true</option>
    </chart>
    <chart>
      <searchName>OSS Mail Gateway - Events by Recipient (Chart)</searchName>
      <title>Events by Recipient</title>
      <option name="charting.chart">pie</option>
      <option name="charting.chart.showlabels">true</option>
      <option name="charting.chart.showpercent">true</option>
    </chart>
  </row>

and so on.

The searches are of the form:

[Mail Gateway - Events by Recipient (Chart)]
action.email.inline = 1
alert.digest_mode = True
alert.suppress = 0
alert.track = 0
dispatch.earliest_time = -2d
displayview = report_builder_display
request.ui_dispatch_view = report_builder_display
search = index="mcafee_mail" sourcetype="mcafee_toaster" Application="smtp" | stats count by to | sort -count

and they work fine, however the segment labels are not displayed on the pie chart (only the "other" label appears). The leaders are displayed for every segment label. Is there a limit to the length of a label? The labels should be e-mail addresses, and are mostly at least 20 characters long.

Tags (2)
0 Karma

Simon_Fishel
Splunk Employee
Splunk Employee

There is no limit on the length of the labels...

First off - though I doubt this is the source of your problem - the charting option tags should look like this (note the camel case in the option names):

<option name="charting.chart.showLabels">true</option>
<option name="charting.chart.showPercent">true<option>

And actually showLabels defaults to true for pie charts so you can leave that out if you want.

Can you post a screen shot of one of these charts? It would also be helpful if you could post the search results in table form, either by running one of the searches in the timeline page or by adding a table to your dashboard.

Lastly, what do you see when you hover over one of the slices? Does the tooltip have the right label or is it also blank?

psneathen
New Member

Perfect. This worked great for me. Thank you.

0 Karma

FunPolice
Path Finder

I've been sidetracked on this one, sorry - I'll get some screen shots up as soon as I can. The "From" field is blank in the tooltip as well.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI! Discover how Splunk’s agentic AI ...

[Puzzles] Solve, Learn, Repeat: Dereferencing XML to Fixed-length events

This challenge was first posted on Slack #puzzles channelFor a previous puzzle, I needed a set of fixed-length ...

Stay Connected: Your Guide to December Tech Talks, Office Hours, and Webinars!

What are Community Office Hours? Community Office Hours is an interactive 60-minute Zoom series where ...