Dashboards & Visualizations

How to exclude field name from visualization?

rxtawell
New Member

Hello, I have a problem where my graphs on the dashboard are showing the field name as a counted type. (i.e. ROUTE) See picture.

alt text

There is no line that contains 'ROUTE:' in my data as I am using a CSV without headers. My headers are defined in my custom source type.

My search is: source="C:\QS1\WF_LD.CSV" | stats count by "ROUTE"

How can I remove this from the visualization?

Thanks!

0 Karma
1 Solution

to4kawa
Ultra Champion
source="C:\\QS1\\WF_LD.CSV" | stats count by "ROUTE"
|where isnotnull(ROUTE)

OR 

|where ROUTE!=""

hi, @rxtawell
At last, why not remove the line?

and Do you check the statistics ? what's the results?

View solution in original post

0 Karma

dindu
Contributor

Hi,

Could you please provide the sample data for this.
Also, please try the below SPL

Please try and update us whether this works.

| source="C:\\QS1\\WF_LD.CSV" 
|table ROUTE
|where isnotnull(ROUTE)
|stats count as route_count by ROUTE
0 Karma

to4kawa
Ultra Champion
source="C:\\QS1\\WF_LD.CSV" | stats count by "ROUTE"
|where isnotnull(ROUTE)

OR 

|where ROUTE!=""

hi, @rxtawell
At last, why not remove the line?

and Do you check the statistics ? what's the results?

0 Karma

rxtawell
New Member

Thank you, it was as simple as |where ROUTE!=""

0 Karma

richgalloway
SplunkTrust
SplunkTrust

You told Splunk to count the literal string "ROUTE" so that is what it did.

Try source="C:\\QS1\\WF_LD.CSV" | stats count by ROUTE

---
If this reply helps you, Karma would be appreciated.
0 Karma

rxtawell
New Member

Thank you for this. I tried this change but I get the same results.

0 Karma
Get Updates on the Splunk Community!

ATTENTION!! We’re MOVING (not really)

Hey, all! In an effort to keep this Slack workspace secure and also to make our new members' experience easy, ...

Splunk Admins: Build a Smarter Stack with These Must-See .conf25 Sessions

  Whether you're running a complex Splunk deployment or just getting your bearings as a new admin, .conf25 ...

AppDynamics Summer Webinars

This summer, our mighty AppDynamics team is cooking up some delicious content on YouTube Live to satiate your ...