topic Re: How to remove a field from a visualization, but not remove it from search results? in Splunk Search

How to remove a field from a visualization, but not remove it from search results?

ronekarleone — Mon, 23 Jan 2017 13:57:39 GMT

I have search results like this:

Host---------------Description------------ EventSize
127.0.0.1----------Prod DB---------------- 90
127.0.0.2----------Trade Service---------- 34

I need remove "Description" field from visualization (for chart like "EventSize by Host"), but don't remove this field from search results. How can i do that?

Thanks.

UPD.
It isn't dashboard, so it haven't SIMPLE XML. I use this search for my report:

|inputlookup Source_description #add CSV lookup with Descriptions
|fields Host Description
|join 
    [search index=_internal source=*license_usage.log type="Usage"
    |stats sum(b) as b by h
    |eval TotalSizeMB=if(len(b)=0 OR isnull (b), "0.00", round (b/1024/1024,2))
    |fields h, TotyalSizeMB
    |rename h AS Host ]
|fields Host Description ToyalSizeMB
|sort 5 - TotalSizeMB

And i have this statistics and visualization tabs like this:

You can see that description field useless in chart, but usefull in statistics table.
I can use comand like this: " |eval Host=Host." - ".Description |fields - Description " to merge 2 fields, but it isn't the best solution, because it becomes difficult to read Host field.

So, how can i remove this field from chart, but save it in statistics search?

Re: How to remove a field from a visualization, but not remove it from search results?

skalliger — Mon, 23 Jan 2017 17:38:18 GMT

Like this?

index=whatever
| fields Host, Description, EventSize
| table Host, EventSize

Skalli

Edit: With your search of course.

Re: How to remove a field from a visualization, but not remove it from search results?

ronekarleone — Tue, 24 Jan 2017 10:16:56 GMT

Thanks for reply, but it doesn't work. Table command remove "description" field from statistics tab in search result. Any ideas?

Re: How to remove a field from a visualization, but not remove it from search results?

rjthibod — Tue, 24 Jan 2017 11:20:59 GMT

The answer depends on the type of visualization you are using, and why you need the Description field to stay in the results.

Can you share some of you SimpleXML that would clarify those two things?

Re: How to remove a field from a visualization, but not remove it from search results?

ronekarleone — Tue, 24 Jan 2017 12:01:33 GMT

Thanks for reply. I added to post all information.

Re: How to remove a field from a visualization, but not remove it from search results?

rjthibod — Tue, 24 Jan 2017 12:09:34 GMT

You can use a post-processing search to generate the chart without the Description.

Assume this is the definition of your table. Note the <search id="base_search>

<table>
  <title>...</title
  <search id="base_search>
    <query>
 |inputlookup Source_description #add CSV lookup with Descriptions
 |fields Host Description
 |join 
     [search index=_internal source=*license_usage.log type="Usage"
     |stats sum(b) as b by h
     |eval TotalSizeMB=if(len(b)=0 OR isnull (b), "0.00", round (b/1024/1024,2))
     |fields h, TotyalSizeMB
     |rename h AS Host ]
 |fields Host Description ToyalSizeMB
 |sort 5 - TotalSizeMB
    </query>
  </search>
</table>

Then you can use <search base="base_search"> as a post-processing search to remove that one field.

<chart>
  <title>...</title
  <search base="base_search">
    <query>
      fields Host ToyalSizeMB
    </query>
  </search>
  <option name="charting.chart">column</option>
</chart>

Re: How to remove a field from a visualization, but not remove it from search results?

ronekarleone — Fri, 03 Feb 2017 11:40:38 GMT

It's nice solution for dashboards, but not for reports (saved searchs). But in any case, thank you! This is the best answer for this moment.

Re: How to remove a field from a visualization, but not remove it from search results?

rjthibod — Fri, 03 Feb 2017 12:03:11 GMT

I did not know you needed it for a saved search/report. If that is the case, it would be helpful for you to restate the desired configuration, for example, what fields need to be available where.

Re: How to remove a field from a visualization, but not remove it from search results?

f5x6kb8 — Tue, 27 Jun 2017 13:36:40 GMT

I am in a similar situation as was presented in this instance. Suppose we use it and continue on? Is there a way...in saved reports...to 'hide' the field DESCRIPTION in the chart, but still have it present in the table/results?

Re: How to remove a field from a visualization, but not remove it from search results?

ronekarleone — Thu, 27 Jul 2017 18:47:19 GMT

Hi! I didn't find solution for saved reports. So i have changed this project and now use dasboards instead saved reports.
First panel is "EventSize by Host" chart and second panel is "host, description, EventSize" table.
It's only solution that i found.

Re: How to remove a field from a visualization, but not remove it from search results?

rjthibod — Thu, 27 Jul 2017 18:51:11 GMT

Please accept my answer if the gist of it demonstrated how to fix the issue in the case of dashboards