Dashboards & Visualizations

How to exclude field name from visualization?

New Member

Hello, I have a problem where my graphs on the dashboard are showing the field name as a counted type. (i.e. ROUTE) See picture.

alt text

There is no line that contains 'ROUTE:' in my data as I am using a CSV without headers. My headers are defined in my custom source type.

My search is: source="C:\QS1\WF_LD.CSV" | stats count by "ROUTE"

How can I remove this from the visualization?

Thanks!

0 Karma
1 Solution

SplunkTrust
SplunkTrust
source="C:\\QS1\\WF_LD.CSV" | stats count by "ROUTE"
|where isnotnull(ROUTE)

OR 

|where ROUTE!=""

hi, @rxtawell
At last, why not remove the line?

and Do you check the statistics ? what's the results?

View solution in original post

0 Karma

Contributor

Hi,

Could you please provide the sample data for this.
Also, please try the below SPL

Please try and update us whether this works.

| source="C:\\QS1\\WF_LD.CSV" 
|table ROUTE
|where isnotnull(ROUTE)
|stats count as route_count by ROUTE
0 Karma

SplunkTrust
SplunkTrust
source="C:\\QS1\\WF_LD.CSV" | stats count by "ROUTE"
|where isnotnull(ROUTE)

OR 

|where ROUTE!=""

hi, @rxtawell
At last, why not remove the line?

and Do you check the statistics ? what's the results?

View solution in original post

0 Karma

New Member

Thank you, it was as simple as |where ROUTE!=""

0 Karma

SplunkTrust
SplunkTrust

You told Splunk to count the literal string "ROUTE" so that is what it did.

Try source="C:\\QS1\\WF_LD.CSV" | stats count by ROUTE

---
If this reply helps you, an upvote would be appreciated.
0 Karma

New Member

Thank you for this. I tried this change but I get the same results.

0 Karma