Dashboards & Visualizations

Dashboard timechart query problem

rbochen
New Member

How do I present ONLY "allErrorsPerMile" on a timechart? Now it looks like on the attachment

 "exception1" OR "exception2" OR "exception3" OR "call"
        | eval calls = if(like(message, "%call%"), 1, 0)
        | eval errors1 = if(like(message, "%exception1%"), 1, 0)
        | eval errors2 = if(like(message, "%exception2%"), 1, 0)
        | eval errors3 = if(like(message, "%exception3%"), 1, 0)
        | timechart sum(errors1) AS errors1 sum(errors2) AS errors2 sum(errors3) AS errors3 sum(calls) AS calls 
        | eval allErrorsPerMile=if(calls>0, ((errors1 + errors2 + errors3)*1000)/calls, calls = 1)

alt text

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

Hi

Can you please try this one?

 "exception1" OR "exception2" OR "exception3" OR "call"
         | eval calls = if(like(message, "%call%"), 1, 0)
         | eval errors1 = if(like(message, "%exception1%"), 1, 0)
         | eval errors2 = if(like(message, "%exception2%"), 1, 0)
         | eval errors3 = if(like(message, "%exception3%"), 1, 0)
         | timechart sum(errors1) AS errors1 sum(errors2) AS errors2 sum(errors3) AS errors3 sum(calls) AS calls 
         | eval allErrorsPerMile=if(calls>0, ((errors1 + errors2 + errors3)*1000)/calls, calls = 1)
| fields _time  allErrorsPerMile

I have just added "| fields _time allErrorsPerMile".

Thanks

0 Karma

rbochen
New Member

did it with charting.data.fieldHideList

0 Karma
Get Updates on the Splunk Community!

Enterprise Security (ES) Essentials 8.3 is Now GA — Smarter Detections, Faster ...

As of today, Enterprise Security (ES) Essentials 8.3 is now generally available, helping SOC teams simplify ...

AI for AppInspect

We’re excited to announce two new updates to AppInspect designed to save you time and make the app approval ...

App Platform's 2025 Year in Review: A Year of Innovation, Growth, and Community

As we step into 2026, it’s the perfect moment to reflect on what an extraordinary year 2025 was for the Splunk ...