Splunk Search

Pie chart labels blank (except "Other")

FunPolice
Path Finder

I have some pie charts on a dashboard:

<dashboard>
  <label>Mail Gateway Summary</label>
  <row>`
    <chart>
      <searchName>Mail Gateway - Events by Sender (Chart)</searchName>
      <title>Events by Sender</title>
      <option name="charting.chart">pie</option>
      <option name="charting.chart.showlabels">true</option>
    </chart>
    <chart>
      <searchName>OSS Mail Gateway - Events by Recipient (Chart)</searchName>
      <title>Events by Recipient</title>
      <option name="charting.chart">pie</option>
      <option name="charting.chart.showlabels">true</option>
      <option name="charting.chart.showpercent">true</option>
    </chart>
  </row>

and so on.

The searches are of the form:

[Mail Gateway - Events by Recipient (Chart)]
action.email.inline = 1
alert.digest_mode = True
alert.suppress = 0
alert.track = 0
dispatch.earliest_time = -2d
displayview = report_builder_display
request.ui_dispatch_view = report_builder_display
search = index="mcafee_mail" sourcetype="mcafee_toaster" Application="smtp" | stats count by to | sort -count

and they work fine, however the segment labels are not displayed on the pie chart (only the "other" label appears). The leaders are displayed for every segment label. Is there a limit to the length of a label? The labels should be e-mail addresses, and are mostly at least 20 characters long.

Tags (2)
0 Karma

Simon_Fishel
Splunk Employee
Splunk Employee

There is no limit on the length of the labels...

First off - though I doubt this is the source of your problem - the charting option tags should look like this (note the camel case in the option names):

<option name="charting.chart.showLabels">true</option>
<option name="charting.chart.showPercent">true<option>

And actually showLabels defaults to true for pie charts so you can leave that out if you want.

Can you post a screen shot of one of these charts? It would also be helpful if you could post the search results in table form, either by running one of the searches in the timeline page or by adding a table to your dashboard.

Lastly, what do you see when you hover over one of the slices? Does the tooltip have the right label or is it also blank?

psneathen
New Member

Perfect. This worked great for me. Thank you.

0 Karma

FunPolice
Path Finder

I've been sidetracked on this one, sorry - I'll get some screen shots up as soon as I can. The "From" field is blank in the tooltip as well.

0 Karma
Get Updates on the Splunk Community!

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...

Adoption of Infrastructure Monitoring at Splunk

  Splunk's Growth Engineering team showcases one of their first Splunk product adoption-Splunk Infrastructure ...