Splunk Search

[box plot] How could I delete "trace 0" data not declared?

Questioner
Path Finder

I try to do box plot using viz.
But I can see the "trace 0" data graph in box plot. ( I don't have any data called "trace 0")

 

This is my code,

<row>
<panel>
<viz type="splunk_plotly_collection_viz.boxplot">
<search>
<query>
.....
| eval total_time=case(time<= 8, "8", time<= 9, "8~9", time<= 10, "9~10", time<= 11, "10~11", time<= 15, "11~15", time<= 20, "15~20")
| table total_time init_dt
</query>
</search>
<option name="drilldown">all</option>
<option name="refresh.display">progressbar</option>
<option name="trellis.enabled">0</option>
</viz>
</panel>
</row>

 and this is the current state of my graph.

Questioner_0-1705482672829.pngQuestioner_0-1705482672829.png

How could I delete "trace 0" in the graph?

 

Labels (1)
Tags (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

If you're using the Box Plot viz at https://splunkbase.splunk.com/app/3157 then it's an archived app that probably is outdated and may have compatibility issues.  Consider trying the box plot viz available in https://splunkbase.splunk.com/app/5730.

That said, does the time field have values greater than 20?  If so, the lack of a default condition will cause the case function will set total_time to null, which might generate the "trace 0" graph points.

| eval total_time=case(time<= 8, "8", time<= 9, "8~9", time<= 10, "9~10", time<= 11, "10~11", time<= 15, "11~15", time<= 20, "15~20", 1==1, ">20")

 

---
If this reply helps you, Karma would be appreciated.

View solution in original post

Questioner
Path Finder

@richgalloway  
It work! That 'trace0' show out of condition data like > 20.
Thank you for your help!

bowesmana
SplunkTrust
SplunkTrust

I see you are already using the Plotly boxplot charts.

I can't confirm, but it seems it may be something inside the Plotly code itself - that viz is made by Splunk Works, but I'm not sure who looks after that.

Can you check in your browser develop tools to see if there is anything reported in the Console log?

 

0 Karma

richgalloway
SplunkTrust
SplunkTrust

If you're using the Box Plot viz at https://splunkbase.splunk.com/app/3157 then it's an archived app that probably is outdated and may have compatibility issues.  Consider trying the box plot viz available in https://splunkbase.splunk.com/app/5730.

That said, does the time field have values greater than 20?  If so, the lack of a default condition will cause the case function will set total_time to null, which might generate the "trace 0" graph points.

| eval total_time=case(time<= 8, "8", time<= 9, "8~9", time<= 10, "9~10", time<= 11, "10~11", time<= 15, "11~15", time<= 20, "15~20", 1==1, ">20")

 

---
If this reply helps you, Karma would be appreciated.
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Agentic SOC Triage: Investigating Splunk ES Notables with MCP Server and a Local LLM

The Problem: Too Many Alerts, Too Little Context Security operations teams running Splunk Enterprise Security ...

All Work and No Play? Not at .conf26! Unwind at These Evening Events

Between hands-on technical sessions, keynote reveals, and diving into live architectures, .conf26 is packed ...

Join the Hackathon at .conf26 and build a No-Code AI agent

Join us for the AI Agent Buildathon, an in-person, three-hour hands-on Hackathon where you’ll use Splunk Agent ...