How to hide columns with "0"

[nanosam]

Hey Splunkers!

I'm very new to Splunk and I really need your help, because I couldn't find a proper solution searching through the topics.

I determine the TotalCount of events containing Field1="Wirecheck" with all Results="Pass", "Reject", "Warn". The percentage of the events with the result "Pass" is determined, as well.

index="IndexTest" Field1="Wirecheck" | stats count as "TotalCountWirecheckField2" by Field2 | appendcols [search index="IndexTest" Field1="Wirecheck" Result="Pass" | stats count as "ResultCountPassWirecheckField2" by field2] | eval percent=(ResultCountPassWirecheckField2/TotalCountWirecheckField2)*100 | eval RoundIntegerWirecheckField2 = round(percent, 1)

I would like to visualize the "Pass"-events using column charts. Next to the height of the columns, which is represented by the TotalCountPass, I'd like to show a range represented by the color of the column. Therefore I have seperated new fields depending on the pass-percentage:

...| eval FieldColorDetectionWirecheckGreen = if(RoundIntegerWirecheckField2>=95, ResultCountPassWirecheckField2, 0) 
| eval FieldColorDetectionWirecheckYellow = if(RoundIntegerWirecheckField2<95 AND RoundIntegerWirecheckField2>=85, ResultCountPassWirecheckField2, 0) 
| eval FieldColorDetectionWirecheckRed = if(RoundIntegerWirecheckField2<85 AND RoundIntegerWirecheckField2>=0, ResultCountPassWirecheckField2, 0) 
| stats values(FieldColorDetectionWirecheckGreen) values(FieldColorDetectionWirecheckYellow) values(FieldColorDetectionWirecheckRed) by Field2

Depending on the percentage, the according column is set equal to the TotalCountPass.

 <option name="charting.fieldColors">{"values(FieldColorDetectionWirecheckGreen)":0x009900, "values(FieldColorDetectionWirecheckYellow)":0xFF9900, "values(FieldColorDetectionWirecheckRed)":0xFF0000}</option>

I'm not satisfied with my solution, because the width of "zero"-columns is still visible.

Question 1a: Is there a possibility to remove the columns of the value="0"?

Question 1b: Or do you know a solution to improve my search that avoids this problem?   

Question 2: Is there a possibility to add the value(RoundIntegerWirecheckField2) in the information Box (I don't know the explicit name for the popup-field)?

I hope you could understand the explanation of my problem 🙂 Thanks in advance ❤️

Nanosam

[nanosam · Accepted solution]

Hi everybody,

I've found a simple way, without changing my query. I chose stacked up column charts. The 0-values aren't visible anymore.

<option name="charting.chart.stackMode">stacked</option>

Result:

 Think outside the box! 😵