Dashboards & Visualizations

Hide/show "other" series in a Dashboard without re-searching

amomchilov
Explorer

I have a dashboard with three radio buttons to select the "Style" of all graphs on my dashboard:

  1. "Relative breakdown": An area chart that's stacked 100%, and shows the "other" series
  2. "Absolute breakdown": An area chart that's stacked, and shows the "other" series
  3. "Raw comparison": A line chart that's not stacked, and hides the "other" series

They're defined like so:

<label>Style</label>
<choice value="style_relative">Relative breakdown</choice>
<choice value="style_absolute">Absolute breakdown</choice>
<choice value="style_compare">Raw comparison</choice>
<change>
  <condition label="Relative breakdown">
    <set token="chartType">area</set>
    <set token="stackMode">stacked100</set>
    <set token="useother">t</set>
  </condition>
  <condition label="Absolute breakdown">
    <set token="chartType">area</set>
    <set token="stackMode">stacked</set>
    <set token="useother">t</set>
  </condition>
  <condition label="Raw comparison">
    <set token="chartType">line</set>
    <set token="stackMode">default</set>
    <set token="useother">f</set>
  </condition>
</change>

Is it possible to set useother=t on my timechart, and then only/show hide it in the visualization layer? That way toggling doesn't require a full re-run of the search?

0 Karma

DalJeanis
Legend

All you have to do is write a base search that calculates all the categories, then a postprocessing search that eliminates the "other" category and recalculates.

With regard to your visualization, you have two (or three) different panels, one which shows the results of each search, and use depends or rejects to determine which to show.

0 Karma
Get Updates on the Splunk Community!

How to Get Started with Splunk Data Management Pipeline Builders (Edge Processor & ...

If you want to gain full control over your growing data volumes, check out Splunk’s Data Management pipeline ...

Out of the Box to Up And Running - Streamlined Observability for Your Cloud ...

  Tech Talk Streamlined Observability for Your Cloud Environment Register    Out of the Box to Up And Running ...

Splunk Smartness with Brandon Sternfield | Episode 3

Hello and welcome to another episode of "Splunk Smartness," the interview series where we explore the power of ...