Splunk Search

Why is my pie chart not displaying the percentage count for each of my 24 rows of data?

nsshey
Explorer

I have a search that properly pulls all the information up, under the statistics tab, there are a total of 24 rows.

I want the pie chart to represent all 24 rows individally as a percentage by count of each of the 24 rows. I've already grouped all my results the way I want them to be through the search.

For some reason, the piechart is grouping the rows in a strange way, as such:
90% - one row
8.1 % - 22 of the rows, and it sums up the count for those
~ 1% - 1 other row

How can I fix this?

0 Karma
1 Solution

woodcock
Esteemed Legend

Edit the XML to change the value of the sliceCollapsingThreshold to 0 to disable collapsing; read about how the panel collapses values into "other" (see sliceCollapsingThreshold):

http://docs.splunk.com/Documentation/Splunk/6.2.3/AdvancedDev/CustomChartingConfig-chartlegend#piech...

By default, values that make up less that 1% of the whole are collapsed into "other".

View solution in original post

woodcock
Esteemed Legend

Edit the XML to change the value of the sliceCollapsingThreshold to 0 to disable collapsing; read about how the panel collapses values into "other" (see sliceCollapsingThreshold):

http://docs.splunk.com/Documentation/Splunk/6.2.3/AdvancedDev/CustomChartingConfig-chartlegend#piech...

By default, values that make up less that 1% of the whole are collapsed into "other".

nsshey
Explorer

where is this config file located? I see documentation for a list of config files, but nothing about where layout.chart sits?
http://docs.splunk.com/Documentation/Splunk/6.2.3/Admin/Listofconfigurationfiles

0 Karma

nsshey
Explorer

Do you know how I can set the pie chart to display the top N amount of values and combine the rest into other?

0 Karma

woodcock
Esteemed Legend

It is not in a config file, it is in your Simple XML. Click Edit Source on the upper right of your dashboard.

Get Updates on the Splunk Community!

Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars this month. This ...

They're back! Join the SplunkTrust and MVP at .conf24

With our highly anticipated annual conference, .conf, comes the fez-wearers you can trust! The SplunkTrust, as ...

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...