I'm trying to do a rangemap pie chart to show ranges (0-40, 40-100, and everything else).
If I do 2 ranges (0-40 and everything else), the chart looks fine, but if I add the middle range, the default changes to "other(x)", where x tends to be a 1 or 2.
All permutations of the rangemap give me the same result if there are 3 ranges.
Am I formatting something wrong?
Splunk 4.3.4. Rangemap is:
| rangemap field=avserv normal=0-40 elevated=40-100 default=high | stats count by range
Regardless of what I call the default, I end up with "other" on my graph, regardless of what I name the other fields.
... View more