Dashboards & Visualizations

How to display an "other" bar in a bar chart?

pgoldweic
Communicator

I'd like to display up to a certain number of data points in a bar chart in a way that the rest of the items which do *not* get displayed are collapsed into one bar: "other". Is there a way to do this? I'm aware that I can simply set the maximum number of data points to display, but this provides no information about the rest, which is what I'm trying to do.  I'm using the Splunjs framework to create the visualization in an app external to Splunk. 

Labels (1)
Tags (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
-- your seaarch
| sort - countfield
| eventstats sum(countfield) as total
| head 8
| eventstats sum(countfield) as partial 
| sort countfield
| streamstats count as row
| eval row=if(row = 1, mvappend(row,"0"), row)
| mvexpand row
| eval dimension=if(row = 0, "Other", dimension)
| eval countfield=if(row = 0, total - partial, countfield)
| sort - row
| fields - row partial total

View solution in original post

0 Karma

pgoldweic
Communicator

Thanks for your reply! It looks like I've deleted my original response to this post by mistake :-(.  I understand this as a clever work-around for the fact that the feature is not supported (as built-in) in bar charts. I am not familiar yet with some of the commands in your query, but I'll them up as they seem pretty useful. Thanks!

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
-- your seaarch
| sort - countfield
| eventstats sum(countfield) as total
| head 8
| eventstats sum(countfield) as partial 
| sort countfield
| streamstats count as row
| eval row=if(row = 1, mvappend(row,"0"), row)
| mvexpand row
| eval dimension=if(row = 0, "Other", dimension)
| eval countfield=if(row = 0, total - partial, countfield)
| sort - row
| fields - row partial total
0 Karma
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Wednesday, May 29, 2024  |  11AM PST / 2PM ESTRegister now and join us to learn more about how you can ...

Get Your Exclusive Splunk Certified Cybersecurity Defense Engineer Certification at ...

We’re excited to announce a new Splunk certification exam being released at .conf24! If you’re headed to Vegas ...