Dashboards & Visualizations

Hide/show "other" series in a Dashboard without re-searching


I have a dashboard with three radio buttons to select the "Style" of all graphs on my dashboard:

  1. "Relative breakdown": An area chart that's stacked 100%, and shows the "other" series
  2. "Absolute breakdown": An area chart that's stacked, and shows the "other" series
  3. "Raw comparison": A line chart that's not stacked, and hides the "other" series

They're defined like so:

<choice value="style_relative">Relative breakdown</choice>
<choice value="style_absolute">Absolute breakdown</choice>
<choice value="style_compare">Raw comparison</choice>
  <condition label="Relative breakdown">
    <set token="chartType">area</set>
    <set token="stackMode">stacked100</set>
    <set token="useother">t</set>
  <condition label="Absolute breakdown">
    <set token="chartType">area</set>
    <set token="stackMode">stacked</set>
    <set token="useother">t</set>
  <condition label="Raw comparison">
    <set token="chartType">line</set>
    <set token="stackMode">default</set>
    <set token="useother">f</set>

Is it possible to set useother=t on my timechart, and then only/show hide it in the visualization layer? That way toggling doesn't require a full re-run of the search?

0 Karma


All you have to do is write a base search that calculates all the categories, then a postprocessing search that eliminates the "other" category and recalculates.

With regard to your visualization, you have two (or three) different panels, one which shows the results of each search, and use depends or rejects to determine which to show.

0 Karma
Get Updates on the Splunk Community!

Part 2: Diving Deeper With AIOps

Getting the Most Out of Event Correlation and Alert Storm Detection in Splunk IT Service Intelligence   Watch ...

User Groups | Upcoming Events!

If by chance you weren't already aware, the Splunk Community is host to numerous User Groups, organized ...

Splunk Lantern | Spotlight on Security: Adoption Motions, War Stories, and More

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...