Dashboards & Visualizations

Not show a row on chart but be available on results

HScorp
New Member

I'm trying to show a pie-chart distributed by country that when you go into view-results you can export to a csv.

A requirement is to include the totals, so I used "| addcoltotals labelfield=country label=ALL" of course now the pie chart have a 50% that corresponds to the country "ALL". Is there a way to exclude this row just from the chart representation? (Without just creating two different reports)

Tags (1)
0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Not too pretty, but this might work:

| gentimes start=-1 increment=5m | eval divider = starttime % 900 | stats avg(starttime) as avg by divider | eval total = avg | addcoltotals total | eval total = if(isnull(divider),total,null)
0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Put the "| gentimes ..." into the search bar on its own, to get a full example with generated events.

0 Karma

HScorp
New Member

I tried but tells me that gentimes have to be the first command. This is the original query:
earliest=-1d@d sourcetype="singleline_json" _type="UserReport" | stats dc(userId) AS "Number users" by country | addcoltotals labelfield=country label=ALL

So I tried: earliest=-1d@d sourcetype="singleline_json" _type="UserReport" | stats dc(userId) AS "Number users" by country | gentimes start=-1 increment=5m | eval divider = starttime % 900 | stats avg(starttime) as avg by divider | eval total = avg | addcoltotals total | eval total = if(isnull(divider),total,null)

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...