Hi I have this graph and the item DETRACTOR appears: NULL I think due to the by which has 2 parameters.
I would like not to display the: NULL for Detractors, is there a way to remove it from the display?
Tks
This is the code.
index=.........
|table Mese,MOTIVO_KO,PERCENTUALE,DETRACTOR
|chart values(PERCENTUALE) as %, values(DETRACTOR) as DETRACTOR by Mese, MOTIVO_KO
| rename "DETRACTOR: NULL" as DETRACTOR
Don't work 😞
I believe that the NULL depends on the BY i.e. after the by there are 2 parameters and since DETRACTOR has only the month, the other parameter for him is NULL
Did you put the rename after the chart?
yes, i put rename after the chart command
I think the problem is in the REASON_KO.
If I remove the command chart, here is the table.
it's not a big deal, it's just for better viewing
| makeresults
| eval _raw="Mese,MOTIVO_KO,PERCENTUALE,DETRACTOR
2020/05,,,6
2020/05,Tecnico,31,
2020/05,Supporto PM,31,
2020/05,Commerciale,38,"
| multikv forceheader=1
| fields - _* linecount
| chart values(PERCENTUALE) as %, values(DETRACTOR) as DETRACTOR by Mese, MOTIVO_KO
| rename "DETRACTOR: NULL" as DETRACTOR
Great !!!
it was enough just to put the space between: and NULL 🙂 🙂 🙂
I never would have thought that 🙂
Tks
You are the best !!!!
Bye
Antonio
I got an idea ....
since it is only visualization, can I somehow with <option name = "charting.legend.mode"> standard </option> or similar change the text? that is, after i: truncates the string.
Could it be a valid solution?
hi @antonio147
sure you can try but for me it's not really clear why the decontractor field take :null at name field.
also you can try to use rename comand if is a only display error.
| chart values (PERCENTUAL) as%, values (DETRACTOR) as DETRACTOR by Mese, MOTIVO_KO
if you see the table, the PERCENTAGE has the value based on the month and the graph differs by REASON_KO.
So the percentage has a value based on the month and the reason for the KO; while DETRACTOR has only the value per month and not for reason.
In fact, if I insert fillnull, I unpack DETRACTOR for the 3 REASONS of KO.
That's why splunk inserts: NULL
The purpose could be achieved by playing with strings, a lot and only one label.
did you try to put
| rename "DETRACTOR: NULL" as DETRACTOR
after the chart?
Hi @antonio147
try to put this at end of the search
fillnull value = 0
or
index=.........
| where isnotnull(DETRACTOR)
|table Mese,MOTIVO_KO,PERCENTUALE,DETRACTOR
|chart values(PERCENTUALE) as %, values(DETRACTOR) as DETRACTOR by Mese, MOTIVO_KO
Ciao
Alessandro
Hi Alessandro, unfortunately with fillnull = 0 it also returns me values of coomercial DETRACTOR, etc ... = 0 and the chartis not good.
With the second solution, on the other hand, it makes the percentages disappear and anyway the: NULL remains.
I think it is due to the fact that the by has both Mese and MOTIVO_KO where in reality DETRACTOR has only the Mese as a field and not the MOTIVO_KO, in addition to its value.
Tks
Hi @antonio147
can help if you can share the entire search.
anyway try this option on chart comand
|chart values(PERCENTUALE) as %, values(DETRACTOR) as DETRACTOR by Mese, MOTIVO_KO usenull=f
with usenull = f it removes all the DETRACTOR graph 😞
this is the entire research.
(index=indice_1 sourcetype=cruscotto ZONA= "Totale") OR (index=indice_1 sourcetype=DETRACT)
|eval anno=mvindex(split(AMBITO,"-"),1)
|eval mese=mvindex(split(AMBITO,"-"),0)
| eval mesi=case(
mese="Gennaio","01",
mese="Febbraio","02",
mese="Marzo","03",
mese="Aprile","04",
mese="Maggio","05",
mese="Giugno","06",
mese="Luglio","07",
mese="Agosto","08",
mese="Settembre","09",
mese="Ottobre","10",
mese="Novembre","11",
mese="Dicembre","12",
1=1, "INV")
|eval Mese = anno."/".mesi
|sort Mese
|table Mese,MOTIVO_KO,PERCENTUALE,DETRACTOR
|chart values(PERCENTUALE) as %, values(DETRACTOR) as DETRACTOR by Mese, MOTIVO_KO