Splunk Search

How to exclude fields for a stats graph

mrcportillo
Engager

Hi there,
I'm new in splunk, I have this portion of query with a stats function, but I just need some fields in the line chart.

     stats sum(TotalOK) as TOTALOK sum(TotalOKlw) as TOTALOKlw   by theTime | eval prom=(TOTALOKlw/3) | eval diferencia=prom-TOTALOK

Right now I have a line chart with all those fields, how can I exclude the field TOTALOKlw from the graph?.
Thanks in advance

Cheers

Tags (4)
0 Karma
1 Solution

aweitzman
Motivator

Tack the following onto the end of your search:

| fields - TOTALOKlw

So:

... 
| stats sum(TotalOK) as TOTALOK sum(TotalOKlw) as TOTALOKlw   by theTime 
| eval prom=(TOTALOKlw/3) 
| eval diferencia=prom-TOTALOK 
| fields - TOTALOKlw

View solution in original post

Raghav2384
Motivator

you can add a pipe at the end to exclude that field....something like

.....your search...|fields - TOTALOKlw

Hope this helps!

Thanks,
Raghav

0 Karma

aweitzman
Motivator

Tack the following onto the end of your search:

| fields - TOTALOKlw

So:

... 
| stats sum(TotalOK) as TOTALOK sum(TotalOKlw) as TOTALOKlw   by theTime 
| eval prom=(TOTALOKlw/3) 
| eval diferencia=prom-TOTALOK 
| fields - TOTALOKlw

woodcock
Esteemed Legend
... | fields - TOTALOKlw
Get Updates on the Splunk Community!

Splunk APM: New Product Features + Community Office Hours Recap!

Howdy Splunk Community! Over the past few months, we’ve had a lot going on in the world of Splunk Application ...

Index This | Forward, I’m heavy; backward, I’m not. What am I?

April 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

A Guide To Cloud Migration Success

As enterprises’ rapid expansion to the cloud continues, IT leaders are continuously looking for ways to focus ...