Splunk Search

useother=f in tstats query? for piechart visualization

mprreddy51
Explorer

Hi,

I have a tstats query and I want to display all "others" in piechart .below is my query:

|tstats count AS "Count of Event Object" from datamodel=abcoper where (nodename = EventObject) groupby "EventObject.ysdDash_consumer"

my pie chart is showing
a=20%
b=30%
c=40%
others=10%

I used USEOTHER=F in the end of the query. but still i am not getting the result.

Any ideas how to use useother=f in tstats?

0 Karma

mprreddy51
Explorer

Thanks Somesh

0 Karma

somesoni2
SplunkTrust
SplunkTrust

That is not the limitation of tstats command but the default behavior of pie chart visualization. By default, all the slices smaller than 1% will be clubbed together under slice "others". This behavior is controlled by attribute charting.chart.sliceCollapsingThreshold. Set this to 0 to show every slice.

See this for more details. http://docs.splunk.com/Documentation/Splunk/latest/Viz/ChartConfigurationReference#Pie_charts

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...