Dashboards & Visualizations

Dashboard timechart query problem

rbochen
New Member

How do I present ONLY "allErrorsPerMile" on a timechart? Now it looks like on the attachment

 "exception1" OR "exception2" OR "exception3" OR "call"
        | eval calls = if(like(message, "%call%"), 1, 0)
        | eval errors1 = if(like(message, "%exception1%"), 1, 0)
        | eval errors2 = if(like(message, "%exception2%"), 1, 0)
        | eval errors3 = if(like(message, "%exception3%"), 1, 0)
        | timechart sum(errors1) AS errors1 sum(errors2) AS errors2 sum(errors3) AS errors3 sum(calls) AS calls 
        | eval allErrorsPerMile=if(calls>0, ((errors1 + errors2 + errors3)*1000)/calls, calls = 1)

alt text

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

Hi

Can you please try this one?

 "exception1" OR "exception2" OR "exception3" OR "call"
         | eval calls = if(like(message, "%call%"), 1, 0)
         | eval errors1 = if(like(message, "%exception1%"), 1, 0)
         | eval errors2 = if(like(message, "%exception2%"), 1, 0)
         | eval errors3 = if(like(message, "%exception3%"), 1, 0)
         | timechart sum(errors1) AS errors1 sum(errors2) AS errors2 sum(errors3) AS errors3 sum(calls) AS calls 
         | eval allErrorsPerMile=if(calls>0, ((errors1 + errors2 + errors3)*1000)/calls, calls = 1)
| fields _time  allErrorsPerMile

I have just added "| fields _time allErrorsPerMile".

Thanks

0 Karma

rbochen
New Member

did it with charting.data.fieldHideList

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...

Updated Data Type Articles, Anniversary Celebrations, and More on Splunk Lantern

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

A Prelude to .conf25: Your Guide to Splunk University

Heading to Boston this September for .conf25? Get a jumpstart by arriving a few days early for Splunk ...