Dashboards & Visualizations

How to hide columns with "0"

nanosam
Explorer

Hey Splunkers!

 

 

I'm very new to Splunk and I really need your help, because I couldn't find a proper solution searching through the topics.

 

I determine the TotalCount of events containing Field1="Wirecheck" with all Results="Pass", "Reject", "Warn". The percentage of the events with the result "Pass" is determined, as well.

 

 

 

 

index="IndexTest" Field1="Wirecheck" | stats count as "TotalCountWirecheckField2" by Field2 | appendcols [search index="IndexTest" Field1="Wirecheck" Result="Pass" | stats count as "ResultCountPassWirecheckField2" by field2] | eval percent=(ResultCountPassWirecheckField2/TotalCountWirecheckField2)*100 | eval RoundIntegerWirecheckField2 = round(percent, 1)

 

 

 

 

 

I would like to visualize the "Pass"-events using column charts. Next to the height of the columns, which is represented by the TotalCountPass, I'd like to show a range represented by the color of the column. Therefore I have seperated new fields depending on the pass-percentage:

 

 

 

...| eval FieldColorDetectionWirecheckGreen = if(RoundIntegerWirecheckField2>=95, ResultCountPassWirecheckField2, 0) 
| eval FieldColorDetectionWirecheckYellow = if(RoundIntegerWirecheckField2<95 AND RoundIntegerWirecheckField2>=85, ResultCountPassWirecheckField2, 0) 
| eval FieldColorDetectionWirecheckRed = if(RoundIntegerWirecheckField2<85 AND RoundIntegerWirecheckField2>=0, ResultCountPassWirecheckField2, 0) 
| stats values(FieldColorDetectionWirecheckGreen) values(FieldColorDetectionWirecheckYellow) values(FieldColorDetectionWirecheckRed) by Field2

 

 

 

 

Depending on the percentage, the according column is set equal to the TotalCountPass.

 

 

 

 <option name="charting.fieldColors">{"values(FieldColorDetectionWirecheckGreen)":0x009900, "values(FieldColorDetectionWirecheckYellow)":0xFF9900, "values(FieldColorDetectionWirecheckRed)":0xFF0000}</option>

 

 

 

 

I'm not satisfied with my solution, because the width of "zero"-columns is still visible.

GapsColumns.JPG

 

Question 1a: Is there a possibility to remove the columns of the value="0"?

Question 1b: Or do you know a solution to improve my search that avoids this problem?   

 

Question 2: Is there a possibility to add the value(RoundIntegerWirecheckField2) in the information Box (I don't know the explicit name for the popup-field)?

AddInfo.png

 

I hope you could understand the explanation of my problem 🙂 Thanks in advance ❤️

Nanosam

Labels (1)
Tags (2)
0 Karma
1 Solution

nanosam
Explorer

Hi everybody,

I've found a simple way, without changing my query. I chose stacked up column charts. The 0-values aren't visible anymore.

<option name="charting.chart.stackMode">stacked</option>

Result:

StackedColumns.JPG

 

 Think outside the box! 😵

View solution in original post

0 Karma

nanosam
Explorer

Hi everybody,

I've found a simple way, without changing my query. I chose stacked up column charts. The 0-values aren't visible anymore.

<option name="charting.chart.stackMode">stacked</option>

Result:

StackedColumns.JPG

 

 Think outside the box! 😵

View solution in original post

0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!