Splunk Search

Why is field missing in piechart?

Shan
Builder

Hi All,

Need your support in resolving an issue in a pie chart. I can see the below-mentioned results in statistics and pie chat while running in a separate search window. 

When adding the same pie chart to dashboard panel. Failed filed is missing in pie chart. 

We have tried charting.chart.sliceCollapsingThreshold with 0 also. No luck.

While dashboard is loading we can able to see the field Failed. But not able see it after job completes.  

Shan_0-1655724829541.png

Please provide you inputs. Thanks in Advance 🙂 

Labels (2)
0 Karma

KendallW
Path Finder

I have replicated the issue and here's what I have found

Only the top four values will be shown on the pie chart no matter how many fields are present in the table and no matter what value is used in Minimum Size / sliceCollapsingThreshold if there are:

  • six or more fields
  • at least one of them is significantly smaller than the largest number 
  • the sum of all values is greater than 64,250

Test it yourself: Run this search and look what happens when you change the value of 'f' from 53138 to 53139

| makeresults 

| eval a=1 
| eval b=10
| eval c=100
| eval d=1000
| eval e=10000
| eval f=53138

| fields - _time 
| transpose 
| rename column as Status, "row 1" as count

Screenshot 2024-04-02 170732.png

 

 

 

Could someone from Splunk please explain what is going on here, or add this to the known issues?

 

0 Karma

bowesmana
SplunkTrust
SplunkTrust

It appears to be related to the size of the visualisation. I changed f to be 100003138 and still I see all 6 slices

bowesmana_0-1712098014086.png

but if I simply change the size of the visualisation area of the pie chart I will see this

bowesmana_1-1712098057430.png

 

jackdeng
Engager

Thank you so much for the explanations - appreciate it!

 

it display all the fields now if I make the size of the piechart super large...

it still doesn't display all the fields if there are two piecharts side by side in the same row of a dashboard though, if the smallest percentage is too small. but it works well if it occupies an entire row.

 

Also to me this is still a bit un-intuitive for the users...

0 Karma

bowesmana
SplunkTrust
SplunkTrust

Yes, that is very odd that it just removes fields if the viz space is not big enough and certainly not intuitive!

0 Karma

KendallW
Path Finder

That is so funny I never even thought of that 😄 

@Shan could you confirm if @bowesmana's reply answers your question and accept it as the answer if so

0 Karma

bowesmana
SplunkTrust
SplunkTrust

Nor did I when I answered 2 years ago 😁

0 Karma

jackdeng
Engager

I am encountering exactly the same issue - only 6 fields but one of them is collapsed. 

Also tried charting.chart.sliceCollapsingThreshold = 0 - no luck

0 Karma

bowesmana
SplunkTrust
SplunkTrust

Odd... Do you only have 6 status slices? The collapsing setting only applies when there are more than 10 slices.

I cannot recreate the same - what version of Splunk are you using?

 

0 Karma

marysan
Communicator

Hi
how many rows do your table have ? (6 rows ? or more ?)
please put a screen shot hear
(I think you must change Format visualization in your dashboard panel with replacing very smaller value)

0 Karma

Shan
Builder

Hi All,

Any Suggestions..

Thanks..

0 Karma

Shan
Builder

Hi All,

Any idea..

Thanks..

0 Karma
Get Updates on the Splunk Community!

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...