Hello All,
I am using Trellis format to display unique / distinct count of log sources in our environment. Below is my query and the dashboard output. Notice how it shows "distinct_..." at the top of the box . How to remove this ? I just want it to show the title OKTA and not the field name or whatever on top of the boxes
Below is my query for the above OKTA log source
| tstats dc(host) as distinct_count where index=okta sourcetype="OktaIM2:log"
Thanks in advance
The search you provided isn't in the format where using Trellis makes sense. Turn off Trellis for the Single Value visualization you are using and the "distinct_count" will disappear.