Splunk Enterprise

Remove unused columns in trellis charts

StuReeves
Explorer

Hi I'm trying to remove unused columns from a trellis style bar chart. I think it's getting mixed up because at some point all reference points have a number, but point to point can be 0. I've removed the 0's from the corresponding table but it still shows in the chart
A truncated part of the search is below:

host=SessionManager |  stats count by "sip_entities.originating","sip_entities.terminating" | where count>0 |chart sum(count) over "sip_entities.originating" by sip_entities.terminating

I use trellis mode to generate a chart for every row under Column "A", which is perfect.
However every individual chart also shows listings for for all of the columns (A-I) regardless if the value is blank . I only want to show column in each chart if they have a value over 0.
For example if Row 2 of Column A has only a value in column I, I don't want to see the others in the chart.
If Row 6 of column A has entries in A-F and H-I, I want it to miss out column G for that generated chart

I hope this makes sense,

Stu..

cmerriman
Super Champion

I'm not sure if you have gotten this answered yet, but could you try using |stats sum(count) as sum_count by "sip_entities.originating" sip_entities.terminating and see if that works for you.
The chart function will create a column for every field in the by command, regardless of if there is a value, so it'll put something in the chart visualization. stats, on the other hand, will just calculate for the fields that have values.

Get Updates on the Splunk Community!

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...

Splunk Enterprise Security 8.x: The Essential Upgrade for Threat Detection, ...

Watch On Demand the Tech Talk on November 6 at 11AM PT, and empower your SOC to reach new heights! Duration: ...

Splunk Observability as Code: From Zero to Dashboard

For the details on what Self-Service Observability and Observability as Code is, we have some awesome content ...