Dashboards & Visualizations

How to show single value in chart

allansneddon
Explorer

I currently have this query:

index="network_services" sourcetype="emails" spam_status=positive | timechart span=1d count | delta count as Delta | fillnull value=0 Delta | eval Total=count-Delta | eval percIncrDecr=(Delta/Total)*100 |

I would like my chart to show only the percIncrDecr, at the moment it shows count, delta, Total and percincrdecr. Is there a way to show only the one variable?

Cheers,

Allan

Tags (1)
0 Karma
1 Solution

niketn
Legend

You have two options to achieve this.

1) Filter unwanted fields in SPL using fields command

 index="network_services" sourcetype="emails" spam_status=positive 
| timechart span=1d count 
| delta count as Delta 
| fillnull value=0 Delta 
| eval Total=count-Delta 
| eval percIncrDecr=(Delta/Total)*100 
| fields - count Delta Total

2) Using Chart Configuration charting.chart.fieldHideList

<option name="charting.chart.fieldHideList">["count","Delta","Total"]</option>

PS: Only advantage of the second would be that the field will be hidden fron display however, you can still code them for Chart Drilldown. If you don't need these fields at all then it is better to filter them through query in the first approach.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

niketn
Legend

You have two options to achieve this.

1) Filter unwanted fields in SPL using fields command

 index="network_services" sourcetype="emails" spam_status=positive 
| timechart span=1d count 
| delta count as Delta 
| fillnull value=0 Delta 
| eval Total=count-Delta 
| eval percIncrDecr=(Delta/Total)*100 
| fields - count Delta Total

2) Using Chart Configuration charting.chart.fieldHideList

<option name="charting.chart.fieldHideList">["count","Delta","Total"]</option>

PS: Only advantage of the second would be that the field will be hidden fron display however, you can still code them for Chart Drilldown. If you don't need these fields at all then it is better to filter them through query in the first approach.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...