Splunk Search

Pie chart labels blank (except "Other")

FunPolice
Path Finder

I have some pie charts on a dashboard:

<dashboard>
  <label>Mail Gateway Summary</label>
  <row>`
    <chart>
      <searchName>Mail Gateway - Events by Sender (Chart)</searchName>
      <title>Events by Sender</title>
      <option name="charting.chart">pie</option>
      <option name="charting.chart.showlabels">true</option>
    </chart>
    <chart>
      <searchName>OSS Mail Gateway - Events by Recipient (Chart)</searchName>
      <title>Events by Recipient</title>
      <option name="charting.chart">pie</option>
      <option name="charting.chart.showlabels">true</option>
      <option name="charting.chart.showpercent">true</option>
    </chart>
  </row>

and so on.

The searches are of the form:

[Mail Gateway - Events by Recipient (Chart)]
action.email.inline = 1
alert.digest_mode = True
alert.suppress = 0
alert.track = 0
dispatch.earliest_time = -2d
displayview = report_builder_display
request.ui_dispatch_view = report_builder_display
search = index="mcafee_mail" sourcetype="mcafee_toaster" Application="smtp" | stats count by to | sort -count

and they work fine, however the segment labels are not displayed on the pie chart (only the "other" label appears). The leaders are displayed for every segment label. Is there a limit to the length of a label? The labels should be e-mail addresses, and are mostly at least 20 characters long.

Tags (2)
0 Karma

Simon_Fishel
Splunk Employee
Splunk Employee

There is no limit on the length of the labels...

First off - though I doubt this is the source of your problem - the charting option tags should look like this (note the camel case in the option names):

<option name="charting.chart.showLabels">true</option>
<option name="charting.chart.showPercent">true<option>

And actually showLabels defaults to true for pie charts so you can leave that out if you want.

Can you post a screen shot of one of these charts? It would also be helpful if you could post the search results in table form, either by running one of the searches in the timeline page or by adding a table to your dashboard.

Lastly, what do you see when you hover over one of the slices? Does the tooltip have the right label or is it also blank?

psneathen
New Member

Perfect. This worked great for me. Thank you.

0 Karma

FunPolice
Path Finder

I've been sidetracked on this one, sorry - I'll get some screen shots up as soon as I can. The "From" field is blank in the tooltip as well.

0 Karma
Get Updates on the Splunk Community!

Index This | When is October more than just the tenth month?

October 2025 Edition  Hayyy Splunk Education Enthusiasts and the Eternally Curious!   We’re back with this ...

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

What’s New & Next in Splunk SOAR

 Security teams today are dealing with more alerts, more tools, and more pressure than ever.  Join us for an ...