https://community.splunk.com/t5/Splunk-Enterprise/How-to-remove-fields-with-zero-value-in-chart-command/m-p/607615#M13493 <P>Have you tried adding <FONT face="courier new,courier">| where count &gt; 0</FONT> to the end of the query?</P> Sat, 30 Jul 2022 16:41:40 GMT richgalloway 2022-07-30T16:41:40Z https://community.splunk.com/t5/Splunk-Enterprise/How-to-remove-fields-with-zero-value-in-chart-command/m-p/607603#M13492 <P>Hello everybody&nbsp;<BR />my query :</P> <P>&nbsp;</P> <LI-CODE lang="markup">index=logarithm SrcAddr="192.168.148.1" |eval flag=case(DestAddr="192.168.148.7" OR DestAddr="192.168.148.8" OR DestAddr="192.168.148.24" ,"LAN 1",DestAddr="192.168.148.21" OR DestAddr="192.168.148.36" OR DestAddr="192.168.148.37" ,"LAN 4" , DestAddr="192.168.148.33" OR DestAddr="192.168.148.34" OR DestAddr="192.168.148.35","LAN 5") |chart count over flag by DestAddr useother=f usenull=f</LI-CODE> <P>&nbsp;</P> <P><BR /><BR />and in trellis mode there are all DestAddrs for each flag! (as we can see in picture)<BR />but I want not to show DestAddrs with 0 values in every chart&nbsp;<BR />by "LAN 1" just show&nbsp;"192.168.148.7" or&nbsp; "192.168.148.8"&nbsp; or "192.168.148.24"<BR />by "LAN 4" just show&nbsp;"192.168.148.21" or&nbsp; "192.168.148.36"&nbsp; or "192.168.148.37"<BR />by "LAN 5" just show&nbsp;"192.168.148.33" or&nbsp; "192.168.148.34"&nbsp; or "192.168.148.35<span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="question.png" style="width: 999px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/20757i17C1BC635108376E/image-size/large?v=v2&amp;px=999" role="button" title="question.png" alt="question.png" /></span>"</P> Sat, 30 Jul 2022 22:23:10 GMT https://community.splunk.com/t5/Splunk-Enterprise/How-to-remove-fields-with-zero-value-in-chart-command/m-p/607603#M13492 marysan 2022-07-30T22:23:10Z https://community.splunk.com/t5/Splunk-Enterprise/How-to-remove-fields-with-zero-value-in-chart-command/m-p/607615#M13493 <P>Have you tried adding <FONT face="courier new,courier">| where count &gt; 0</FONT> to the end of the query?</P> Sat, 30 Jul 2022 16:41:40 GMT https://community.splunk.com/t5/Splunk-Enterprise/How-to-remove-fields-with-zero-value-in-chart-command/m-p/607615#M13493 richgalloway 2022-07-30T16:41:40Z https://community.splunk.com/t5/Splunk-Enterprise/How-to-remove-fields-with-zero-value-in-chart-command/m-p/607636#M13495 <P>yes<BR />it doesn't work . shows nothing !</P> Sun, 31 Jul 2022 08:27:00 GMT https://community.splunk.com/t5/Splunk-Enterprise/How-to-remove-fields-with-zero-value-in-chart-command/m-p/607636#M13495 marysan 2022-07-31T08:27:00Z https://community.splunk.com/t5/Splunk-Enterprise/How-to-remove-fields-with-zero-value-in-chart-command/m-p/607641#M13496 <P>this problem was resolved by using&nbsp;|stats count as count by flag, DestAddr&nbsp;</P> Sun, 31 Jul 2022 09:50:48 GMT https://community.splunk.com/t5/Splunk-Enterprise/How-to-remove-fields-with-zero-value-in-chart-command/m-p/607641#M13496 marysan 2022-07-31T09:50:48Z