Why is field missing in piechart?

[Shan]

Hi All,

Need your support in resolving an issue in a pie chart. I can see the below-mentioned results in statistics and pie chat while running in a separate search window. 

When adding the same pie chart to dashboard panel. Failed filed is missing in pie chart. 

We have tried charting.chart.sliceCollapsingThreshold with 0 also. No luck.

While dashboard is loading we can able to see the field Failed. But not able see it after job completes.  

Please provide you inputs. Thanks in Advance 🙂 

[KendallW]

I have replicated the issue and here's what I have found

Only the top four values will be shown on the pie chart no matter how many fields are present in the table and no matter what value is used in Minimum Size / sliceCollapsingThreshold if there are:

• six or more fields
• at least one of them is significantly smaller than the largest number 
• the sum of all values is greater than 64,250

Test it yourself: Run this search and look what happens when you change the value of 'f' from 53138 to 53139

| makeresults 

| eval a=1 
| eval b=10
| eval c=100
| eval d=1000
| eval e=10000
| eval f=53138

| fields - _time 
| transpose 
| rename column as Status, "row 1" as count

Could someone from Splunk please explain what is going on here, or add this to the known issues?

[bowesmana]

It appears to be related to the size of the visualisation. I changed f to be 100003138 and still I see all 6 slices

but if I simply change the size of the visualisation area of the pie chart I will see this

[jackdeng]

Thank you so much for the explanations - appreciate it!

it display all the fields now if I make the size of the piechart super large...

it still doesn't display all the fields if there are two piecharts side by side in the same row of a dashboard though, if the smallest percentage is too small. but it works well if it occupies an entire row.

Also to me this is still a bit un-intuitive for the users...

[bowesmana]

Yes, that is very odd that it just removes fields if the viz space is not big enough and certainly not intuitive!

[KendallW]

That is so funny I never even thought of that 😄 

@Shan could you confirm if @bowesmana's reply answers your question and accept it as the answer if so

[bowesmana]

Nor did I when I answered 2 years ago 😁

[jackdeng]

I am encountering exactly the same issue - only 6 fields but one of them is collapsed. 

Also tried charting.chart.sliceCollapsingThreshold = 0 - no luck

[bowesmana]

Odd... Do you only have 6 status slices? The collapsing setting only applies when there are more than 10 slices.

I cannot recreate the same - what version of Splunk are you using?

[marysan]

Hi
how many rows do your table have ? (6 rows ? or more ?)
please put a screen shot hear
(I think you must change Format visualization in your dashboard panel with replacing very smaller value)

[Shan]

Hi All,

Any Suggestions..

Thanks..

[Shan]

Hi All,

Any idea..

Thanks..