Splunk Enterprise

Remove unused columns in trellis charts

StuReeves
Explorer

Hi I'm trying to remove unused columns from a trellis style bar chart. I think it's getting mixed up because at some point all reference points have a number, but point to point can be 0. I've removed the 0's from the corresponding table but it still shows in the chart
A truncated part of the search is below:

host=SessionManager |  stats count by "sip_entities.originating","sip_entities.terminating" | where count>0 |chart sum(count) over "sip_entities.originating" by sip_entities.terminating

I use trellis mode to generate a chart for every row under Column "A", which is perfect.
However every individual chart also shows listings for for all of the columns (A-I) regardless if the value is blank . I only want to show column in each chart if they have a value over 0.
For example if Row 2 of Column A has only a value in column I, I don't want to see the others in the chart.
If Row 6 of column A has entries in A-F and H-I, I want it to miss out column G for that generated chart

I hope this makes sense,

Stu..

cmerriman
Super Champion

I'm not sure if you have gotten this answered yet, but could you try using |stats sum(count) as sum_count by "sip_entities.originating" sip_entities.terminating and see if that works for you.
The chart function will create a column for every field in the by command, regardless of if there is a value, so it'll put something in the chart visualization. stats, on the other hand, will just calculate for the fields that have values.

Get Updates on the Splunk Community!

New in Observability - Improvements to Custom Metrics SLOs, Log Observer Connect & ...

The latest enhancements to the Splunk observability portfolio deliver improved SLO management accuracy, better ...

Improve Data Pipelines Using Splunk Data Management

  Register Now   This Tech Talk will explore the pipeline management offerings Edge Processor and Ingest ...

3-2-1 Go! How Fast Can You Debug Microservices with Observability Cloud?

Register Join this Tech Talk to learn how unique features like Service Centric Views, Tag Spotlight, and ...