Splunk Search

How to get a multiseries line chart to display values for A and B based on time, but have a third value that is constant?

Champion

I have a multi series line chart as follows for the below series (lines)
A,B,BThreshold

Now, BThreshold is of course a constant value. In the chart, I need to show values for A and B as they go up or down with time. BThreshold, however, is one constant value.
When I apply show data values to the chart settings it applies values for all 3 series. However, I need to show running values for only A and B, but not for Bthreshold as it is just one straight line. Need to remove the data value for BThreshold, while still showing data values for A and B.

Tags (3)

Legend
0 Karma

Champion

That doesn't work out. Adding a series as an overlay does not at all remove any data labels/values from it.
What I am looking for i think is some configuration in simple xml which can hide the data labels from the overlay while showing it for the rest of the line series.

0 Karma

Champion

hmm no answers on this one...is this not possible at all 😞 😞 ???

0 Karma

Explorer

I'm also looking for this solution, did you every find something that worked?

0 Karma

Champion
How about
| fields - <removed field>
or
| table _time <rest of fields>
r, Ismo
0 Karma