Dashboards & Visualizations

How to hide columns with "0"

nanosam
Explorer

Hey Splunkers!

 

 

I'm very new to Splunk and I really need your help, because I couldn't find a proper solution searching through the topics.

 

I determine the TotalCount of events containing Field1="Wirecheck" with all Results="Pass", "Reject", "Warn". The percentage of the events with the result "Pass" is determined, as well.

 

 

 

 

index="IndexTest" Field1="Wirecheck" | stats count as "TotalCountWirecheckField2" by Field2 | appendcols [search index="IndexTest" Field1="Wirecheck" Result="Pass" | stats count as "ResultCountPassWirecheckField2" by field2] | eval percent=(ResultCountPassWirecheckField2/TotalCountWirecheckField2)*100 | eval RoundIntegerWirecheckField2 = round(percent, 1)

 

 

 

 

 

I would like to visualize the "Pass"-events using column charts. Next to the height of the columns, which is represented by the TotalCountPass, I'd like to show a range represented by the color of the column. Therefore I have seperated new fields depending on the pass-percentage:

 

 

 

...| eval FieldColorDetectionWirecheckGreen = if(RoundIntegerWirecheckField2>=95, ResultCountPassWirecheckField2, 0) 
| eval FieldColorDetectionWirecheckYellow = if(RoundIntegerWirecheckField2<95 AND RoundIntegerWirecheckField2>=85, ResultCountPassWirecheckField2, 0) 
| eval FieldColorDetectionWirecheckRed = if(RoundIntegerWirecheckField2<85 AND RoundIntegerWirecheckField2>=0, ResultCountPassWirecheckField2, 0) 
| stats values(FieldColorDetectionWirecheckGreen) values(FieldColorDetectionWirecheckYellow) values(FieldColorDetectionWirecheckRed) by Field2

 

 

 

 

Depending on the percentage, the according column is set equal to the TotalCountPass.

 

 

 

 <option name="charting.fieldColors">{"values(FieldColorDetectionWirecheckGreen)":0x009900, "values(FieldColorDetectionWirecheckYellow)":0xFF9900, "values(FieldColorDetectionWirecheckRed)":0xFF0000}</option>

 

 

 

 

I'm not satisfied with my solution, because the width of "zero"-columns is still visible.

GapsColumns.JPG

 

Question 1a: Is there a possibility to remove the columns of the value="0"?

Question 1b: Or do you know a solution to improve my search that avoids this problem?   

 

Question 2: Is there a possibility to add the value(RoundIntegerWirecheckField2) in the information Box (I don't know the explicit name for the popup-field)?

AddInfo.png

 

I hope you could understand the explanation of my problem 🙂 Thanks in advance ❤️

Nanosam

Labels (1)
Tags (2)
0 Karma
1 Solution

nanosam
Explorer

Hi everybody,

I've found a simple way, without changing my query. I chose stacked up column charts. The 0-values aren't visible anymore.

<option name="charting.chart.stackMode">stacked</option>

Result:

StackedColumns.JPG

 

 Think outside the box! 😵

View solution in original post

0 Karma

nanosam
Explorer

Hi everybody,

I've found a simple way, without changing my query. I chose stacked up column charts. The 0-values aren't visible anymore.

<option name="charting.chart.stackMode">stacked</option>

Result:

StackedColumns.JPG

 

 Think outside the box! 😵

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...