Splunk Search

Pie chart labels blank (except "Other")

FunPolice
Path Finder

I have some pie charts on a dashboard:

<dashboard>
  <label>Mail Gateway Summary</label>
  <row>`
    <chart>
      <searchName>Mail Gateway - Events by Sender (Chart)</searchName>
      <title>Events by Sender</title>
      <option name="charting.chart">pie</option>
      <option name="charting.chart.showlabels">true</option>
    </chart>
    <chart>
      <searchName>OSS Mail Gateway - Events by Recipient (Chart)</searchName>
      <title>Events by Recipient</title>
      <option name="charting.chart">pie</option>
      <option name="charting.chart.showlabels">true</option>
      <option name="charting.chart.showpercent">true</option>
    </chart>
  </row>

and so on.

The searches are of the form:

[Mail Gateway - Events by Recipient (Chart)]
action.email.inline = 1
alert.digest_mode = True
alert.suppress = 0
alert.track = 0
dispatch.earliest_time = -2d
displayview = report_builder_display
request.ui_dispatch_view = report_builder_display
search = index="mcafee_mail" sourcetype="mcafee_toaster" Application="smtp" | stats count by to | sort -count

and they work fine, however the segment labels are not displayed on the pie chart (only the "other" label appears). The leaders are displayed for every segment label. Is there a limit to the length of a label? The labels should be e-mail addresses, and are mostly at least 20 characters long.

Tags (2)
0 Karma

Simon_Fishel
Splunk Employee
Splunk Employee

There is no limit on the length of the labels...

First off - though I doubt this is the source of your problem - the charting option tags should look like this (note the camel case in the option names):

<option name="charting.chart.showLabels">true</option>
<option name="charting.chart.showPercent">true<option>

And actually showLabels defaults to true for pie charts so you can leave that out if you want.

Can you post a screen shot of one of these charts? It would also be helpful if you could post the search results in table form, either by running one of the searches in the timeline page or by adding a table to your dashboard.

Lastly, what do you see when you hover over one of the slices? Does the tooltip have the right label or is it also blank?

psneathen
New Member

Perfect. This worked great for me. Thank you.

0 Karma

FunPolice
Path Finder

I've been sidetracked on this one, sorry - I'll get some screen shots up as soon as I can. The "From" field is blank in the tooltip as well.

0 Karma
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...