It is possible not to display ": NULL" in the graph when by has 2 parameters

[antonio147]

Hi I have this graph and the item DETRACTOR appears: NULL I think due to the by which has 2 parameters.
I would like not to display the: NULL for Detractors, is there a way to remove it from the display?
Tks

This is the code.

index=.........

|table Mese,MOTIVO_KO,PERCENTUALE,DETRACTOR
|chart values(PERCENTUALE) as %, values(DETRACTOR) as DETRACTOR by Mese, MOTIVO_KO

[ITWhisperer · Accepted solution]

| rename "DETRACTOR: NULL" as DETRACTOR

[antonio147]

Don't work 😞

I believe that the NULL depends on the BY i.e. after the by there are 2 parameters and since DETRACTOR has only the month, the other parameter for him is NULL

[ITWhisperer]

Did you put the rename after the chart?

[antonio147]

yes, i put rename after the chart command

I think the problem is in the REASON_KO.
If I remove the command chart, here is the table.

it's not a big deal, it's just for better viewing

[ITWhisperer]

| makeresults 
| eval _raw="Mese,MOTIVO_KO,PERCENTUALE,DETRACTOR
2020/05,,,6
2020/05,Tecnico,31,
2020/05,Supporto PM,31,
2020/05,Commerciale,38,"
| multikv forceheader=1 
| fields - _* linecount
| chart values(PERCENTUALE) as %, values(DETRACTOR) as DETRACTOR by Mese, MOTIVO_KO
| rename "DETRACTOR: NULL" as DETRACTOR

[antonio147]

Great !!!
it was enough just to put the space between: and NULL 🙂 🙂 🙂
I never would have thought that 🙂
Tks
You are the best !!!!
Bye
Antonio

[antonio147]

I got an idea ....
since it is only visualization, can I somehow with <option name = "charting.legend.mode"> standard </option> or similar change the text? that is, after i: truncates the string.
Could it be a valid solution?

[aasabatini]

hi @antonio147 

sure you can try but for me it's not really clear why the decontractor field take :null at name field.

also you can try to use rename comand if is a only display error.

[antonio147]

| chart values (PERCENTUAL) as%, values (DETRACTOR) as DETRACTOR by Mese, MOTIVO_KO
if you see the table, the PERCENTAGE has the value based on the month and the graph differs by REASON_KO.
So the percentage has a value based on the month and the reason for the KO; while DETRACTOR has only the value per month and not for reason.
In fact, if I insert fillnull, I unpack DETRACTOR for the 3 REASONS of KO.
That's why splunk inserts: NULL
The purpose could be achieved by playing with strings, a lot and only one label.

[aasabatini]

did you try to put 

| rename "DETRACTOR: NULL" as DETRACTOR

after the chart?

[aasabatini]

Hi @antonio147 

try to put this at end of the search

fillnull value = 0

or

index=.........
| where isnotnull(DETRACTOR)
|table Mese,MOTIVO_KO,PERCENTUALE,DETRACTOR
|chart values(PERCENTUALE) as %, values(DETRACTOR) as DETRACTOR by Mese, MOTIVO_KO

Ciao 

Alessandro

[antonio147]

Hi Alessandro, unfortunately with fillnull = 0 it also returns me values of coomercial DETRACTOR, etc ... = 0 and the chartis not good.
With the second solution, on the other hand, it makes the percentages disappear and anyway the: NULL remains.
I think it is due to the fact that the by has both Mese and MOTIVO_KO where in reality DETRACTOR has only the Mese as a field and not the MOTIVO_KO, in addition to its value.

Tks

[aasabatini]

Hi @antonio147 

can help if you can  share the entire search.

anyway try this option on chart comand

|chart values(PERCENTUALE) as %, values(DETRACTOR) as DETRACTOR by Mese, MOTIVO_KO usenull=f

[antonio147]

with usenull = f it removes all the DETRACTOR graph 😞

this is the entire research.

(index=indice_1 sourcetype=cruscotto ZONA= "Totale") OR (index=indice_1 sourcetype=DETRACT)

|eval anno=mvindex(split(AMBITO,"-"),1)
|eval mese=mvindex(split(AMBITO,"-"),0)
| eval mesi=case(
mese="Gennaio","01",
mese="Febbraio","02",
mese="Marzo","03",
mese="Aprile","04",
mese="Maggio","05",
mese="Giugno","06",
mese="Luglio","07",
mese="Agosto","08",
mese="Settembre","09",
mese="Ottobre","10",
mese="Novembre","11",
mese="Dicembre","12",
1=1, "INV")

|eval Mese = anno."/".mesi
|sort Mese
|table Mese,MOTIVO_KO,PERCENTUALE,DETRACTOR
|chart values(PERCENTUALE) as %, values(DETRACTOR) as DETRACTOR by Mese, MOTIVO_KO