Splunk Search

Conditionally Omit Bin from Chart

rpecka
Explorer

Hi, I’m trying to make a stacked bar chart visualization where my y axis is milliseconds, my x axis is a task ID, and I’m splitting by a stage ID. My query is:

| chart max("duration") over task_id by "stage_id" | table task_id, stage_1, stage_2, stage_3, *

In my results, tasks where stage 1 occurred are so long that they make all the other bars look really tiny. Is there a way that I could add to my query to filter out the task_ids where stage_1 occurred?

Labels (1)
0 Karma
1 Solution

bowesmana
SplunkTrust
SplunkTrust

You could add a where clause to remove rows where stage_1 values is null or =0

| where isnull(stage_1) OR stage_1=0

or you could make the y-axis log scale, which would reduce the impact of the stage_1 values if that works for you.

 

View solution in original post

bowesmana
SplunkTrust
SplunkTrust

You could add a where clause to remove rows where stage_1 values is null or =0

| where isnull(stage_1) OR stage_1=0

or you could make the y-axis log scale, which would reduce the impact of the stage_1 values if that works for you.

 

Get Updates on the Splunk Community!

Splunk MCP & Agentic AI: Machine Data Without Limits

  Discover how the Splunk Model Context Protocol (MCP) Server can revolutionize the way your organization ...

Finding Based Detections General Availability

Overview  We’ve come a long way, folks, but here in Enterprise Security 8.4 I’m happy to announce Finding ...

Get Your Hands Dirty (and Your Shoes Comfy): The Splunk Experience

Hands-On Learning and Technical Seminars  Sometimes, you just need to see the code. For those looking for a ...