Hi,
I have a tstats query and I want to display all "others" in piechart .below is my query:
|tstats count AS "Count of Event Object" from datamodel=abcoper where (nodename = EventObject) groupby "EventObject.ysdDash_consumer"
my pie chart is showing
a=20%
b=30%
c=40%
others=10%
I used USEOTHER=F in the end of the query. but still i am not getting the result.
Any ideas how to use useother=f in tstats?
Thanks Somesh
That is not the limitation of tstats command but the default behavior of pie chart visualization. By default, all the slices smaller than 1% will be clubbed together under slice "others". This behavior is controlled by attribute charting.chart.sliceCollapsingThreshold
. Set this to 0 to show every slice.
See this for more details. http://docs.splunk.com/Documentation/Splunk/latest/Viz/ChartConfigurationReference#Pie_charts