Dashboards & Visualizations

How to remove a field from visualisation?

zacksoft
Contributor

I intended to check the rate of change of my response time of http requets, for which I use the delta command.
Here is how it goes,

| base query
| timechart span=30s avg(Response_Time) as Response_Time| delta Response_Time as rate_of_change

Now, when it runs, I go to visualiatization and select line chart. It gives me two lines 1. Response_Time 2. rate_of_change.
I don't want response_time , I only want the visualization to show 'rate_of _change'

Tags (1)
0 Karma
1 Solution

TISKAR
Builder

Hello can you try this please:

| base query
| timechart span=30s avg(Response_Time) as Response_Time| delta Response_Time as rate_of_change | fields - Response_Time

View solution in original post

0 Karma

TISKAR
Builder

Hello can you try this please:

| base query
| timechart span=30s avg(Response_Time) as Response_Time| delta Response_Time as rate_of_change | fields - Response_Time
0 Karma

zacksoft
Contributor

cool ! This helps. If I may ask one related question. Instead of evaluating delta of average Response_Time, if I want to calculate delta only of response_time, what change I do? I tried values(Response_Time) it won't work. Thank you.

0 Karma

TISKAR
Builder

Can you accept the answer to help another person please

0 Karma

TISKAR
Builder

Use that:

| base query
| bin _time span=15s
| delta Response_Time as rate_of_change | table rate_of_change , _time
0 Karma

zacksoft
Contributor

The only change I made to your suggestion is, I removed _time from | table and kept rate_of_change only , but somehow the visualizations won't work. (line chart)

0 Karma

TISKAR
Builder

If you want a graphic represent variation rate_of_change by _time you must keep the _time, because if you remove _time you have one field, and line chart represent the variation between two field

0 Karma

TISKAR
Builder

Try by this:

| base query
     | delta Response_Time as rate_of_change | table rate_of_change , _time

Can you accept the answer to help another person please

0 Karma

zacksoft
Contributor

But I seek to find the delta between now and the response time after 15 seconds. .
The above command evaluates Delta between consecutive response time...!!!

0 Karma
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...