Removing "Others" result from chart in advanced XML

[responsys_cm]

I have a chart that is fed results from a search ending in | top limit=10 dest_ip. The chart in the dashboard always renders with the "Others" field that sums the results of all rows that didn't make the top ten.

How can I disable this? The userother=false doesn't disable it...

Thx.

Craig

[MHibbin]

Hi,

Have you verified you "Other" field is not just the sum the remaining "top 10" entries which are not displayed in your chart.

You should also look at the chart's properties (http://docs.splunk.com/Documentation/Splunk/4.3.3/Developer/CustomChartingConfig-chartlegend).

I've had similar issues with "Other", where there may be a hugh difference between the 1st (top) item and subsequent items, as the visual slice would be "too small" to see. For this in my advanced XML under the chart module I would add something like the following...

<param name="charting.chart.sliceCollapsingThreshold">0</param>

This will disable the threshold, and stop the collapsing of results into "other".

For reference check the registered modules by visiting ... http://splunkServer:8000/en-GB/modules#Splunk.Module.HiddenChartFormatter

[sideview]

Right. pie charts have their own "Other" which shows up. Because chart and timechart put out an "OTHER", it's easy to see this and assume it's a search language thing. Charting keys can take it away like you see here. Of ccurse then the pie chart becomes extremely misleading! and in which case you probably shouldn't be using a pie chart.

[Ayn]

Really? That's what useother should be doing. Are you sure you specified it correctly (useother, not userother)?