Refine your search:

Just curious - is it possible to exclude the totals row and column generated by addtotals and addcoltotals from the heatmap visualization? They always show up as the hottest things on the map, distracting from the values which are actually important.

asked 14 Mar '12, 10:56

msarro's gravatar image

msarro
807181166
accept rate: 64%

Can you put the addcoltotals or addtotals commands at the end of the pipeline? If you do, does it make a difference?

(14 Mar '12, 14:45) lguinn ♦

One Answer:

It is not really possible in a "good" way.

You can defeat the inclusion of these values in the heatmap calculation though, say by evaluating them to look less like numbers. For example, add to your search | eval Total = Total . " ." You could pick an arbitrary character here to make it not look like a number.

link

answered 14 Mar '12, 15:35

Stephen%20Sorkin's gravatar image

Stephen Sorkin ♦
9.7k511
accept rate: 52%

Post your answer
toggle preview

Follow this question

Log In to enable email subscriptions

RSS:

Answers

Answers + Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "Title")
  • image?![alt text](/path/img.jpg "Title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Tags:

×9

Asked: 14 Mar '12, 10:56

Seen: 782 times

Last updated: 14 Mar '12, 15:35

Copyright © 2005-2014 Splunk Inc. All rights reserved.