I'm trying to do a rangemap pie chart to show ranges (0-40, 40-100, and everything else).
If I do 2 ranges (0-40 and everything else), the chart looks fine, but if I add the middle range, the default changes to "other(x)", where x tends to be a 1 or 2.
All permutations of the rangemap give me the same result if there are 3 ranges.
Am I formatting something wrong?
Splunk 4.3.4. Rangemap is:
| rangemap field=avserv normal=0-40 elevated=40-100 default=high | stats count by range
Regardless of what I call the default, I end up with "other" on my graph, regardless of what I name the other fields.
Are all values of avserv
numeric? Does avserv
appear in all events? If it doesn't, then some events will have a null value for avserv
. Finally, did you notice that both your ranges have the value 40? You have a range overlap, which is okay.
Try this:
yoursearchhere
| rangemap field=avserv normal=0-40 elevated=40-100 default=high
| table avserv range
OR
yoursearchhere
| rangemap field=avserv normal=0-40 elevated=40-100 default=high
| search range=other*
| table avserv range
Are all values of avserv
numeric? Does avserv
appear in all events? If it doesn't, then some events will have a null value for avserv
. Finally, did you notice that both your ranges have the value 40? You have a range overlap, which is okay.
Try this:
yoursearchhere
| rangemap field=avserv normal=0-40 elevated=40-100 default=high
| table avserv range
OR
yoursearchhere
| rangemap field=avserv normal=0-40 elevated=40-100 default=high
| search range=other*
| table avserv range
I think I actually figured it out. I think part of the problem is that my non-normal results are infinitesimal when compared to normal (just over 1% for elevated and high combined, with high being an even smaller at .3%), and the grapher just can't deal with it.
I see the proper values/names in the results table, and other() only shows up when that proportion is REALLY small (which it generally is).
Thanks!