Splunk Enterprise

Remove unused columns in trellis charts


Hi I'm trying to remove unused columns from a trellis style bar chart. I think it's getting mixed up because at some point all reference points have a number, but point to point can be 0. I've removed the 0's from the corresponding table but it still shows in the chart
A truncated part of the search is below:

host=SessionManager |  stats count by "sip_entities.originating","sip_entities.terminating" | where count>0 |chart sum(count) over "sip_entities.originating" by sip_entities.terminating

I use trellis mode to generate a chart for every row under Column "A", which is perfect.
However every individual chart also shows listings for for all of the columns (A-I) regardless if the value is blank . I only want to show column in each chart if they have a value over 0.
For example if Row 2 of Column A has only a value in column I, I don't want to see the others in the chart.
If Row 6 of column A has entries in A-F and H-I, I want it to miss out column G for that generated chart

I hope this makes sense,


Super Champion

I'm not sure if you have gotten this answered yet, but could you try using |stats sum(count) as sum_count by "sip_entities.originating" sip_entities.terminating and see if that works for you.
The chart function will create a column for every field in the by command, regardless of if there is a value, so it'll put something in the chart visualization. stats, on the other hand, will just calculate for the fields that have values.

Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!