I have an overlay field in a chart where I show average per host and total average.
I am calculating total average as below
timechart span=1h eval(round(avg(value),2)) by Host_HostName | eval _count = 0 | foreach * [eval _count = _count + 1] | addtotals fieldname=value | eval TotalAvgTime = value / _count
It return 4 values
1. Average for host 1
2. Average for host 2
3. value ( calculated in addtotals)
4. TotalAvgTime
In the graph, I want to hide "3" i.e. value (calculated in addtotals). Can you please suggest me how to hide the field in a graph?
Try this
timechart span=1h eval(round(avg(value),2)) by Host_HostName | eval _count = 0 | foreach * [eval _count = _count + 1] | addtotals fieldname=value | eval TotalAvgTime = value / _count | fields - value
Is it possible to hide a field from a chart but not to hide it from the table. For example there are some fields that I wouldn't like to display on a chart, however, I would still like those columns to be visible underneath the chart in a table...Thank you!
Are you using a dashboard with two panels (one chart and one table) OR talking about the Reports view of a saved search (which gives both chart and table underneath) ?
Sorry - I am talking about the Reports view of a saved search. Thanks!