Rangemap shows "other" for 3rd value always

[nandrews]

I'm trying to do a rangemap pie chart to show ranges (0-40, 40-100, and everything else).

If I do 2 ranges (0-40 and everything else), the chart looks fine, but if I add the middle range, the default changes to "other(x)", where x tends to be a 1 or 2.

All permutations of the rangemap give me the same result if there are 3 ranges.

Am I formatting something wrong?

Splunk 4.3.4. Rangemap is:

| rangemap field=avserv normal=0-40 elevated=40-100 default=high | stats count by range

Regardless of what I call the default, I end up with "other" on my graph, regardless of what I name the other fields.

[lguinn2 · Accepted solution]

Are all values of avserv numeric? Does avserv appear in all events? If it doesn't, then some events will have a null value for avserv. Finally, did you notice that both your ranges have the value 40? You have a range overlap, which is okay.

Try this:

yoursearchhere
| rangemap field=avserv normal=0-40 elevated=40-100 default=high 
| table avserv range

OR

yoursearchhere
| rangemap field=avserv normal=0-40 elevated=40-100 default=high 
| search range=other*
| table avserv range

[nandrews]

I think I actually figured it out. I think part of the problem is that my non-normal results are infinitesimal when compared to normal (just over 1% for elevated and high combined, with high being an even smaller at .3%), and the grapher just can't deal with it.

I see the proper values/names in the results table, and other() only shows up when that proportion is REALLY small (which it generally is).

Thanks!