useother=f in tstats query? for piechart visualization

[mprreddy51]

Hi,

I have a tstats query and I want to display all "others" in piechart .below is my query:

|tstats count AS "Count of Event Object" from datamodel=abcoper where (nodename = EventObject) groupby "EventObject.ysdDash_consumer"

my pie chart is showing
a=20%
b=30%
c=40%
others=10%

I used USEOTHER=F in the end of the query. but still i am not getting the result.

Any ideas how to use useother=f in tstats?

[mprreddy51]

Thanks Somesh

[somesoni2]

That is not the limitation of tstats command but the default behavior of pie chart visualization. By default, all the slices smaller than 1% will be clubbed together under slice "others". This behavior is controlled by attribute charting.chart.sliceCollapsingThreshold. Set this to 0 to show every slice.

See this for more details. http://docs.splunk.com/Documentation/Splunk/latest/Viz/ChartConfigurationReference#Pie_charts