Splunk Search

How to hide a field from the legend in a bar chart?

Shan
Builder

Hi,

My current search I'm using to populate the value is given below.

source= transaction.csv    
| stats  values(AppName) as AppName, avg(Response_Time) as AverageResponseTime, max(Response_Time) as MaxResponseTime,
 min(Response_Time) as MinResponseTime   by custonernumber 
| table  custonernumber AppName  AverageResponseTime MaxResponseTime MinResponseTime | head 10

when i'm trying to show the data in bar chart, I'm getting legend names such as AppName AverageResponseTime MaxResponseTime MinResponseTime.
I want to hide or remove AppName from the legend in my bar chart, but I need to do it without removing AppName field from the search above.
I'm using that Appname field for a filter condition in my dashboard, so I cannot remove the Appname field from the above search.

Thanks in advance.

Shankarananth

Tags (3)
0 Karma

mayurr98
Super Champion

hey @shankarananth

add this to dashboard XML

<option name="charting.legend.placement">none</option>

Let me know if it works!

0 Karma

srikanthvaddevo
New Member

can You please tell me how you achieved the answer? ,Can You please tell me how you acheived ?

0 Karma

pwmcity
Path Finder

Have you tried using fields?
Try appending:

| fields - AppName

You could probably also replace table with fields, something like:

| fields custonernumber AverageResponseTime MaxResponseTime MinResponseTime
0 Karma

somesoni2
Revered Legend

Are you using this search as base search? How are you adding filter and is it on other panels?

0 Karma

Shan
Builder

In other panels i can able to add it. because i am using the Appname field t be displayed in that chart else i'm displaying the data as statistics.

0 Karma

Shan
Builder

Hai,

Thank you very much .

I achieved that approach in another way ..

0 Karma

srikanthvaddevo
New Member

May I know how you acheived Mr.Shankaranath?

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars this month. This ...

They're back! Join the SplunkTrust and MVP at .conf24

With our highly anticipated annual conference, .conf, comes the fez-wearers you can trust! The SplunkTrust, as ...

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...