Dashboards & Visualizations

How to show single value in chart

allansneddon
Explorer

I currently have this query:

index="network_services" sourcetype="emails" spam_status=positive | timechart span=1d count | delta count as Delta | fillnull value=0 Delta | eval Total=count-Delta | eval percIncrDecr=(Delta/Total)*100 |

I would like my chart to show only the percIncrDecr, at the moment it shows count, delta, Total and percincrdecr. Is there a way to show only the one variable?

Cheers,

Allan

Tags (1)
0 Karma
1 Solution

niketn
Legend

You have two options to achieve this.

1) Filter unwanted fields in SPL using fields command

 index="network_services" sourcetype="emails" spam_status=positive 
| timechart span=1d count 
| delta count as Delta 
| fillnull value=0 Delta 
| eval Total=count-Delta 
| eval percIncrDecr=(Delta/Total)*100 
| fields - count Delta Total

2) Using Chart Configuration charting.chart.fieldHideList

<option name="charting.chart.fieldHideList">["count","Delta","Total"]</option>

PS: Only advantage of the second would be that the field will be hidden fron display however, you can still code them for Chart Drilldown. If you don't need these fields at all then it is better to filter them through query in the first approach.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

niketn
Legend

You have two options to achieve this.

1) Filter unwanted fields in SPL using fields command

 index="network_services" sourcetype="emails" spam_status=positive 
| timechart span=1d count 
| delta count as Delta 
| fillnull value=0 Delta 
| eval Total=count-Delta 
| eval percIncrDecr=(Delta/Total)*100 
| fields - count Delta Total

2) Using Chart Configuration charting.chart.fieldHideList

<option name="charting.chart.fieldHideList">["count","Delta","Total"]</option>

PS: Only advantage of the second would be that the field will be hidden fron display however, you can still code them for Chart Drilldown. If you don't need these fields at all then it is better to filter them through query in the first approach.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...