https://community.splunk.com/t5/Splunk-Enterprise/Remove-unused-columns-in-trellis-charts/m-p/360070#M999 <P>I'm not sure if you have gotten this answered yet, but could you try using <CODE>|stats sum(count) as sum_count by "sip_entities.originating" sip_entities.terminating</CODE> and see if that works for you.<BR /> The <CODE>chart</CODE> function will create a column for every field in the by command, regardless of if there is a value, so it'll put something in the chart visualization. <CODE>stats</CODE>, on the other hand, will just calculate for the fields that have values. </P> Fri, 13 Apr 2018 13:57:34 GMT cmerriman 2018-04-13T13:57:34Z https://community.splunk.com/t5/Splunk-Enterprise/Remove-unused-columns-in-trellis-charts/m-p/360069#M998 <P>Hi I'm trying to remove unused columns from a trellis style bar chart. I think it's getting mixed up because at some point all reference points have a number, but point to point can be 0. I've removed the 0's from the corresponding table but it still shows in the chart<BR /> A truncated part of the search is below:</P> <BLOCKQUOTE> <PRE><CODE>host=SessionManager | stats count by "sip_entities.originating","sip_entities.terminating" | where count&gt;0 |chart sum(count) over "sip_entities.originating" by sip_entities.terminating </CODE></PRE> </BLOCKQUOTE> <P>I use trellis mode to generate a chart for every row under Column "A", which is perfect.<BR /> However every individual chart also shows listings for for all of the columns (A-I) regardless if the value is blank . I only want to show column in each chart if they have a value over 0.<BR /> For example if Row 2 of Column A has only a value in column I, I don't want to see the others in the chart.<BR /> If Row 6 of column A has entries in A-F and H-I, I want it to miss out column G for that generated chart</P> <P>I hope this makes sense,</P> <P>Stu..</P> Wed, 27 Sep 2017 13:58:56 GMT https://community.splunk.com/t5/Splunk-Enterprise/Remove-unused-columns-in-trellis-charts/m-p/360069#M998 StuReeves 2017-09-27T13:58:56Z https://community.splunk.com/t5/Splunk-Enterprise/Remove-unused-columns-in-trellis-charts/m-p/360070#M999 <P>I'm not sure if you have gotten this answered yet, but could you try using <CODE>|stats sum(count) as sum_count by "sip_entities.originating" sip_entities.terminating</CODE> and see if that works for you.<BR /> The <CODE>chart</CODE> function will create a column for every field in the by command, regardless of if there is a value, so it'll put something in the chart visualization. <CODE>stats</CODE>, on the other hand, will just calculate for the fields that have values. </P> Fri, 13 Apr 2018 13:57:34 GMT https://community.splunk.com/t5/Splunk-Enterprise/Remove-unused-columns-in-trellis-charts/m-p/360070#M999 cmerriman 2018-04-13T13:57:34Z