Solved: Removing Column Headings with Sparkline

balcv · ‎03-06-2019

I have created a search including sparkline:

index=_* type="threat" severity="medium"  | stats sparkline count | table sparkline

and when it displays, I get the heading "sparkline" above the resultant chart, but I would like to remove that heading so that I only see the sparkline.

vnravikumar · ‎03-06-2019

Hi @balcv

Try this and let me know

<dashboard>
  <label>sparkline</label>
  <row>
    <panel>
      <html>
        <style>
          #test th[data-sort-key="sparkline"]{
          display:none !important;
          }
        </style>
      </html>
      <table id="test">
        <search>
          <query>index=_* type="threat" severity="medium"  | stats sparkline count | table sparkline</query>
          <earliest>0</earliest>
          <latest></latest>
        </search>
        <option name="drilldown">none</option>
      </table>
    </panel>
  </row>
</dashboard>

View solution in original post

chrisyounger · ‎03-06-2019

You can also use |rename sparkline as " "

vnravikumar · ‎03-06-2019

Hi @balcv

Try this and let me know

<dashboard>
  <label>sparkline</label>
  <row>
    <panel>
      <html>
        <style>
          #test th[data-sort-key="sparkline"]{
          display:none !important;
          }
        </style>
      </html>
      <table id="test">
        <search>
          <query>index=_* type="threat" severity="medium"  | stats sparkline count | table sparkline</query>
          <earliest>0</earliest>
          <latest></latest>
        </search>
        <option name="drilldown">none</option>
      </table>
    </panel>
  </row>
</dashboard>

balcv · ‎03-06-2019

Perfect, that's exactly what I was after. Simple when you know how. Thank you.

Removing Column Headings with Sparkline

Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!

They're back! Join the SplunkTrust and MVP at .conf24

Enterprise Security Content Update (ESCU) | New Releases