Dashboards & Visualizations

How to hide a field in a chart?

praspai
Path Finder

I have an overlay field in a chart where I show average per host and total average.

I am calculating total average as below

timechart span=1h eval(round(avg(value),2)) by Host_HostName | eval _count = 0 | foreach * [eval _count = _count + 1] | addtotals fieldname=value | eval TotalAvgTime = value / _count

It return 4 values
1. Average for host 1
2. Average for host 2
3. value ( calculated in addtotals)
4. TotalAvgTime

In the graph, I want to hide "3" i.e. value (calculated in addtotals). Can you please suggest me how to hide the field in a graph?

somesoni2
Revered Legend

Try this

timechart span=1h eval(round(avg(value),2)) by Host_HostName | eval _count = 0 | foreach * [eval _count = _count + 1] | addtotals fieldname=value | eval TotalAvgTime = value / _count | fields  - value

demkic
Explorer

Is it possible to hide a field from a chart but not to hide it from the table. For example there are some fields that I wouldn't like to display on a chart, however, I would still like those columns to be visible underneath the chart in a table...Thank you!

somesoni2
Revered Legend

Are you using a dashboard with two panels (one chart and one table) OR talking about the Reports view of a saved search (which gives both chart and table underneath) ?

0 Karma

demkic
Explorer

Sorry - I am talking about the Reports view of a saved search. Thanks!

0 Karma
Get Updates on the Splunk Community!

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...

Splunk Enterprise Security 8.x: The Essential Upgrade for Threat Detection, ...

Watch On Demand the Tech Talk on November 6 at 11AM PT, and empower your SOC to reach new heights! Duration: ...

Splunk Observability as Code: From Zero to Dashboard

For the details on what Self-Service Observability and Observability as Code is, we have some awesome content ...