Splunk Search
Highlighted

Removing "Others" result from chart in advanced XML

Builder

I have a chart that is fed results from a search ending in | top limit=10 dest_ip. The chart in the dashboard always renders with the "Others" field that sums the results of all rows that didn't make the top ten.

How can I disable this? The userother=false doesn't disable it...

Thx.

Craig

Tags (2)
0 Karma
Highlighted

Re: Removing "Others" result from chart in advanced XML

Legend

Really? That's what useother should be doing. Are you sure you specified it correctly (useother, not userother)?

Highlighted

Re: Removing "Others" result from chart in advanced XML

Influencer

Hi,

Have you verified you "Other" field is not just the sum the remaining "top 10" entries which are not displayed in your chart.

You should also look at the chart's properties (http://docs.splunk.com/Documentation/Splunk/4.3.3/Developer/CustomChartingConfig-chartlegend).

I've had similar issues with "Other", where there may be a hugh difference between the 1st (top) item and subsequent items, as the visual slice would be "too small" to see. For this in my advanced XML under the chart module I would add something like the following...

<param name="charting.chart.sliceCollapsingThreshold">0</param>

This will disable the threshold, and stop the collapsing of results into "other".

For reference check the registered modules by visiting ... http://splunkServer:8000/en-GB/modules#Splunk.Module.HiddenChartFormatter

Highlighted

Re: Removing "Others" result from chart in advanced XML

SplunkTrust
SplunkTrust

Right. pie charts have their own "Other" which shows up. Because chart and timechart put out an "OTHER", it's easy to see this and assume it's a search language thing. Charting keys can take it away like you see here. Of ccurse then the pie chart becomes extremely misleading! and in which case you probably shouldn't be using a pie chart.

0 Karma