Dashboards & Visualizations

Dashboard Studio - Remove the _tc column in table

treinke
Builder

Trying to get a nice list of the top 10 countries a firewall is blocking.  If I run the search in the search app, it comes back with the columns of Country and count.  I use Dashboard Studio and I use the same search as a data source and I get Country, count, and _tc.  I am guessing I am missing a flag to not show the total count.

Splunk Search:

(index=netfw OR index=netproxy) (sourcetype="pan:threat" OR sourcetype="pan:traffic") action="dropped" (src_ip!=10.0.0.0/8 AND src_ip!=172.16.0.0/12 AND src_ip!=192.168.0.0/16) | iplocation src_ip | top limit=10 Country showperc=false
| fields Country,count

Studio Visualization:

{
"type": "splunk.table",
"options": {
"showRowNumbers": true
},
"dataSources": {
"primary": "ds_69PTFLxT"
},
"title": "Top 10 Blocked Countries",
"showProgressBar": true,
"context": {},
"showLastUpdated": false
}

There are no answer without questions
Labels (1)
0 Karma

liuweiwell
Explorer

You can use | fields - _tc

or you can use |table field1 field2 ... (just without _tc)

Get Updates on the Splunk Community!

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...

September Community Champions: A Shoutout to Our Contributors!

As we close the books on another fantastic month, we want to take a moment to celebrate the people who are the ...

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...