Splunk Search

How can I remove ONLY the overlay Total on a visualization?

ashidhingra
Path Finder

 

How can I remove ONLY the overlay Total on a visualization? TIA

ashidhingra_0-1726757918291.png

 

Labels (4)
0 Karma

dural_yyz
Motivator

What is your search string behind the viz?  It could be as simple as appending the search with...

| fields - overlay_field_name

ashidhingra
Path Finder
index=
| bucket span=1s _time | stats count by _time | timechart max(count) AS Peak_TPS span=1d
| eval overlay=10

I want to remove the number display on overlay

0 Karma

dural_yyz
Motivator

This is confusing because your search specifically sets the values you want to remove.  Simple solution is to remove the last pipe and eval of the additional field.  Assuming you need that for some alternate reason then I would recommend.

1) Create base search "ds_base" don't include the pipe and eval of the overlay

2) Create the viz and map the data source to the base search

3) Create a chain search which has the pipe and eval of the overlay field and map it to the base

4) Map the alternate need to the chain search as the source

0 Karma

ashidhingra
Path Finder
  1. I dont want to remove the overlay. I only want to remove the number 10. 
0 Karma

ashidhingra
Path Finder

ashidhingra_0-1726769546498.png

 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

If you are using Classic/SimpleXML dashboards, you can do this with CSS.

For this you need to give your panel an id (so it gets tagged so CSS can select it), then you need to know the order of the series in the charts and they are numbered. For example, if you name your panel "panel_one", and your Total was the second series (index 1), you could do something like this

    <panel id="panel_one">
      <html depends="$alwaysHide$">
        <style>
          #panel_one svg g.highcharts-data-labels.highcharts-series-1
          {
            display: none !important;
          }
        </style>
      </html>
      <chart>

dural_yyz
Motivator

When using dashboard studio currently there is no option for this.

dataValuesDisplay("off" | "all" | "minmax")offSpecify whether chart should display no labels, all labels, or only the min and max labels.

https://docs.splunk.com/Documentation/SplunkCloud/9.2.2406/DashStudio/chartsBar

I have even tried putting the overlay into the y2 axis and the dataValuesDisplay is a higher level option so impacts all axis.

{
    "type": "splunk.column",
    "dataSources": {
        "primary": "ds_TNxdC2O9"
    },
    "containerOptions": {},
    "showProgressBar": false,
    "showLastUpdated": false,
    "title": "Column Chart",
    "description": "Overlay Test",
    "options": {
        "y": "> primary | frameBySeriesNames('regular','_span')",
        "y2": "> primary | frameBySeriesNames('overlay','_span')",
        "overlayFields": [
            "overlay"
        ],
        "dataValuesDisplay": "all"
    },
    "context": {}
}
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Yes, Studio is not a good choice for anything vaguely sophisticated!

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Matching cron expressions

This puzzle (first published here) is based on matching timestamps to cron expressions.All the timestamps ...

Design, Compete, Win: Submit Your Best Splunk Dashboards for a .conf26 Pass

Hello Splunkers,  We’re excited to kick off a Splunk Dashboard contest! We know that dashboards are a primary ...

May 2026 Splunk Expert Sessions: Security & Observability

Level Up Your Operations: May 2026 Splunk Expert Sessions Whether you are refining your security posture or ...