Hi there,
I'm new in splunk, I have this portion of query with a stats function, but I just need some fields in the line chart.
stats sum(TotalOK) as TOTALOK sum(TotalOKlw) as TOTALOKlw by theTime | eval prom=(TOTALOKlw/3) | eval diferencia=prom-TOTALOK
Right now I have a line chart with all those fields, how can I exclude the field TOTALOKlw from the graph?.
Thanks in advance
Cheers
Tack the following onto the end of your search:
| fields - TOTALOKlw
So:
...
| stats sum(TotalOK) as TOTALOK sum(TotalOKlw) as TOTALOKlw by theTime
| eval prom=(TOTALOKlw/3)
| eval diferencia=prom-TOTALOK
| fields - TOTALOKlw
you can add a pipe at the end to exclude that field....something like
.....your search...|fields - TOTALOKlw
Hope this helps!
Thanks,
Raghav
Tack the following onto the end of your search:
| fields - TOTALOKlw
So:
...
| stats sum(TotalOK) as TOTALOK sum(TotalOKlw) as TOTALOKlw by theTime
| eval prom=(TOTALOKlw/3)
| eval diferencia=prom-TOTALOK
| fields - TOTALOKlw
... | fields - TOTALOKlw