How to show single value in chart

[allansneddon]

I currently have this query:

index="network_services" sourcetype="emails" spam_status=positive | timechart span=1d count | delta count as Delta | fillnull value=0 Delta | eval Total=count-Delta | eval percIncrDecr=(Delta/Total)*100 |

I would like my chart to show only the percIncrDecr, at the moment it shows count, delta, Total and percincrdecr. Is there a way to show only the one variable?

Cheers,

Allan

[niketn · Accepted solution]

You have two options to achieve this.

1) Filter unwanted fields in SPL using fields command

 index="network_services" sourcetype="emails" spam_status=positive 
| timechart span=1d count 
| delta count as Delta 
| fillnull value=0 Delta 
| eval Total=count-Delta 
| eval percIncrDecr=(Delta/Total)*100 
| fields - count Delta Total

2) Using Chart Configuration charting.chart.fieldHideList

<option name="charting.chart.fieldHideList">["count","Delta","Total"]</option>

PS: Only advantage of the second would be that the field will be hidden fron display however, you can still code them for Chart Drilldown. If you don't need these fields at all then it is better to filter them through query in the first approach.