<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Re: How to exclude fields for a stats graph in Splunk Search</title>
    <link>https://community.splunk.com/t5/Splunk-Search/How-to-exclude-fields-for-a-stats-graph/m-p/141805#M39305</link>
    <description>&lt;P&gt;you can add a pipe at the end to exclude that field....something like&lt;/P&gt;

&lt;P&gt;.....your search...|fields - TOTALOKlw&lt;/P&gt;

&lt;P&gt;Hope this helps!&lt;/P&gt;

&lt;P&gt;Thanks,&lt;BR /&gt;
Raghav&lt;/P&gt;</description>
    <pubDate>Wed, 03 Jun 2015 17:57:21 GMT</pubDate>
    <dc:creator>Raghav2384</dc:creator>
    <dc:date>2015-06-03T17:57:21Z</dc:date>
    <item>
      <title>How to exclude fields for a stats graph</title>
      <link>https://community.splunk.com/t5/Splunk-Search/How-to-exclude-fields-for-a-stats-graph/m-p/141802#M39302</link>
      <description>&lt;P&gt;Hi there,&lt;BR /&gt;
I'm new in splunk, I have this portion of query with a stats function, but I just need some fields in the line chart. &lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;     stats sum(TotalOK) as TOTALOK sum(TotalOKlw) as TOTALOKlw   by theTime | eval prom=(TOTALOKlw/3) | eval diferencia=prom-TOTALOK
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;Right now I have a line chart with all those fields, how can I exclude the field TOTALOKlw from the graph?.&lt;BR /&gt;
Thanks in advance&lt;/P&gt;

&lt;P&gt;Cheers&lt;/P&gt;</description>
      <pubDate>Wed, 03 Jun 2015 17:47:09 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Splunk-Search/How-to-exclude-fields-for-a-stats-graph/m-p/141802#M39302</guid>
      <dc:creator>mrcportillo</dc:creator>
      <dc:date>2015-06-03T17:47:09Z</dc:date>
    </item>
    <item>
      <title>Re: How to exclude fields for a stats graph</title>
      <link>https://community.splunk.com/t5/Splunk-Search/How-to-exclude-fields-for-a-stats-graph/m-p/141803#M39303</link>
      <description>&lt;PRE&gt;&lt;CODE&gt;... | fields - TOTALOKlw
&lt;/CODE&gt;&lt;/PRE&gt;</description>
      <pubDate>Wed, 03 Jun 2015 17:51:08 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Splunk-Search/How-to-exclude-fields-for-a-stats-graph/m-p/141803#M39303</guid>
      <dc:creator>woodcock</dc:creator>
      <dc:date>2015-06-03T17:51:08Z</dc:date>
    </item>
    <item>
      <title>Re: How to exclude fields for a stats graph</title>
      <link>https://community.splunk.com/t5/Splunk-Search/How-to-exclude-fields-for-a-stats-graph/m-p/141804#M39304</link>
      <description>&lt;P&gt;Tack the following onto the end of your search:&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;| fields - TOTALOKlw
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;So:&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;... 
| stats sum(TotalOK) as TOTALOK sum(TotalOKlw) as TOTALOKlw   by theTime 
| eval prom=(TOTALOKlw/3) 
| eval diferencia=prom-TOTALOK 
| fields - TOTALOKlw
&lt;/CODE&gt;&lt;/PRE&gt;</description>
      <pubDate>Wed, 03 Jun 2015 17:52:00 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Splunk-Search/How-to-exclude-fields-for-a-stats-graph/m-p/141804#M39304</guid>
      <dc:creator>aweitzman</dc:creator>
      <dc:date>2015-06-03T17:52:00Z</dc:date>
    </item>
    <item>
      <title>Re: How to exclude fields for a stats graph</title>
      <link>https://community.splunk.com/t5/Splunk-Search/How-to-exclude-fields-for-a-stats-graph/m-p/141805#M39305</link>
      <description>&lt;P&gt;you can add a pipe at the end to exclude that field....something like&lt;/P&gt;

&lt;P&gt;.....your search...|fields - TOTALOKlw&lt;/P&gt;

&lt;P&gt;Hope this helps!&lt;/P&gt;

&lt;P&gt;Thanks,&lt;BR /&gt;
Raghav&lt;/P&gt;</description>
      <pubDate>Wed, 03 Jun 2015 17:57:21 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Splunk-Search/How-to-exclude-fields-for-a-stats-graph/m-p/141805#M39305</guid>
      <dc:creator>Raghav2384</dc:creator>
      <dc:date>2015-06-03T17:57:21Z</dc:date>
    </item>
  </channel>
</rss>

