Dashboards & Visualizations

Hide/show "other" series in a Dashboard without re-searching

amomchilov
Explorer

I have a dashboard with three radio buttons to select the "Style" of all graphs on my dashboard:

  1. "Relative breakdown": An area chart that's stacked 100%, and shows the "other" series
  2. "Absolute breakdown": An area chart that's stacked, and shows the "other" series
  3. "Raw comparison": A line chart that's not stacked, and hides the "other" series

They're defined like so:

<label>Style</label>
<choice value="style_relative">Relative breakdown</choice>
<choice value="style_absolute">Absolute breakdown</choice>
<choice value="style_compare">Raw comparison</choice>
<change>
  <condition label="Relative breakdown">
    <set token="chartType">area</set>
    <set token="stackMode">stacked100</set>
    <set token="useother">t</set>
  </condition>
  <condition label="Absolute breakdown">
    <set token="chartType">area</set>
    <set token="stackMode">stacked</set>
    <set token="useother">t</set>
  </condition>
  <condition label="Raw comparison">
    <set token="chartType">line</set>
    <set token="stackMode">default</set>
    <set token="useother">f</set>
  </condition>
</change>

Is it possible to set useother=t on my timechart, and then only/show hide it in the visualization layer? That way toggling doesn't require a full re-run of the search?

0 Karma

DalJeanis
Legend

All you have to do is write a base search that calculates all the categories, then a postprocessing search that eliminates the "other" category and recalculates.

With regard to your visualization, you have two (or three) different panels, one which shows the results of each search, and use depends or rejects to determine which to show.

0 Karma
Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...