Dashboards & Visualizations
Highlighted

Hide/show "other" series in a Dashboard without re-searching

Explorer

I have a dashboard with three radio buttons to select the "Style" of all graphs on my dashboard:

  1. "Relative breakdown": An area chart that's stacked 100%, and shows the "other" series
  2. "Absolute breakdown": An area chart that's stacked, and shows the "other" series
  3. "Raw comparison": A line chart that's not stacked, and hides the "other" series

They're defined like so:

<label>Style</label>
<choice value="style_relative">Relative breakdown</choice>
<choice value="style_absolute">Absolute breakdown</choice>
<choice value="style_compare">Raw comparison</choice>
<change>
  <condition label="Relative breakdown">
    <set token="chartType">area</set>
    <set token="stackMode">stacked100</set>
    <set token="useother">t</set>
  </condition>
  <condition label="Absolute breakdown">
    <set token="chartType">area</set>
    <set token="stackMode">stacked</set>
    <set token="useother">t</set>
  </condition>
  <condition label="Raw comparison">
    <set token="chartType">line</set>
    <set token="stackMode">default</set>
    <set token="useother">f</set>
  </condition>
</change>

Is it possible to set useother=t on my timechart, and then only/show hide it in the visualization layer? That way toggling doesn't require a full re-run of the search?

0 Karma
Highlighted

Re: Hide/show "other" series in a Dashboard without re-searching

SplunkTrust
SplunkTrust

All you have to do is write a base search that calculates all the categories, then a postprocessing search that eliminates the "other" category and recalculates.

With regard to your visualization, you have two (or three) different panels, one which shows the results of each search, and use depends or rejects to determine which to show.

0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.