hide column where value = 0

BaptVe — Mon, 09 May 2016 07:57:45 GMT

Hello everyone !

I've two panels depending on time (timechart) :
1)

 index=XXX sourcetype="XXXXX" Severity="*" |timechart count(Severity) span=6h

On the picture, this one is right : it only shows between the two times where there is values and hide if the last days where there is no value ! (there is nothing between now and the 4 may at 14:00)

index=XXX sourcetype="XXXXX" Severity="CRITICAL" |timechart count as CRIT span=6h
| appendcols [search
index=XXX sourcetype="XXXXX" Severity="FATAL" |timechart count as FATAL span=6h ]
| appendcols [search 
index=XXX sourcetype="XXXXX" Severity="WARNING" |timechart count as WARN span=6h ]
| table CRIT, FATAL, WARN, _time

On the second graph, it shows the values between now and the 4 may at 14:00 and marks them as 0. I want to hide these values (and make the graph auto resize like the previous one if possible) because these are not relevant and i want to keep the same time range for both graphs :

Thanks for your help !

Re: hide column where value = 0

jplumsdaine22 — Mon, 09 May 2016 08:38:11 GMT

Why not condense the search?

index=XXX sourcetype="XXXXX" (Severity="CRITICAL" OR Severity="WARNING" OR Severity="FATAL") |timechart span=6h count by Severity | rename WARNING AS WARN | rename CRITICAL AS CRIT

Re: hide column where value = 0

BaptVe — Mon, 09 May 2016 08:43:02 GMT

It was what i was looking for !

Thanks 🙂

topic Re: hide column where value = 0 in Splunk Search

hide column where value = 0

Re: hide column where value = 0

Re: hide column where value = 0