Splunk Search

How to remove one field to be shown in column chart

sindhoo
Engager

I have created a query which have 4 columns in statistics and want to show column chart as well but with 3 columns. how to remove extra column in statistics?

base search | stats total count(a) count(b) by Function

Statistics output is -->
Function Total count(a) count(b)
Test 10 6 4

but in chart i dont want to see column of total, only want to see count of a and b per function but dont want to remove it from statistics.

Tags (3)
0 Karma

hexxamillion
Explorer

I am having the same issue. It looks simple enough that this should work but it doesn't. It still keeps TOTAL on my bar chart. It does, however, remove it from statistics table. This is what I am using. How can you remove TOTAL from the charts? I am running version 7.2.0.

... |fields - Total

0 Karma

lacastillo
Path Finder

harishalipaka's comment above should work if you add it to the end of your search. For more info on the fields command please see the docs at

https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Fields

0 Karma

sindhoo
Engager

thanks for your response, but it didnt worked, i mentioned fields in last and in both viz and stats only those fields were shown which were in fields command,

0 Karma

lacastillo
Path Finder

Can you post the search you used?

0 Karma

harishalipaka
Motivator
|fields - Total
Thanks
Harish

sindhoo
Engager

thanks for your response, but it didnt worked, i mentioned fields in last and in both viz and stats only those fields were shown which were in fields command,

0 Karma
Get Updates on the Splunk Community!

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...