Splunk Enterprise

Remove unused columns in trellis charts

StuReeves
Explorer

Hi I'm trying to remove unused columns from a trellis style bar chart. I think it's getting mixed up because at some point all reference points have a number, but point to point can be 0. I've removed the 0's from the corresponding table but it still shows in the chart
A truncated part of the search is below:

host=SessionManager |  stats count by "sip_entities.originating","sip_entities.terminating" | where count>0 |chart sum(count) over "sip_entities.originating" by sip_entities.terminating

I use trellis mode to generate a chart for every row under Column "A", which is perfect.
However every individual chart also shows listings for for all of the columns (A-I) regardless if the value is blank . I only want to show column in each chart if they have a value over 0.
For example if Row 2 of Column A has only a value in column I, I don't want to see the others in the chart.
If Row 6 of column A has entries in A-F and H-I, I want it to miss out column G for that generated chart

I hope this makes sense,

Stu..

cmerriman
Super Champion

I'm not sure if you have gotten this answered yet, but could you try using |stats sum(count) as sum_count by "sip_entities.originating" sip_entities.terminating and see if that works for you.
The chart function will create a column for every field in the by command, regardless of if there is a value, so it'll put something in the chart visualization. stats, on the other hand, will just calculate for the fields that have values.

Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...