Splunk Search

charting.chart.nullvaluemode = gaps not working for Stacked Area charts

keerthana_k
Communicator

Hi

I have a timechart which plots a stacked area chart of multiple series. I want to omit the null values. I tried specifying charting.chart.nullvaluemode as gaps in my view.xml but it did not work. I cannot use usenull=f as I don't have a split-by field. Please suggest how I can achieve this behaviour with Stacked Area charts.

Thanks in Advance.

Tags (2)
0 Karma

theunf
Communicator

I also have a stacked panel , area with gaps and multi-series mode to No.

Upon start of the panel, when page loads, it show only a full filled interval of the graph showing only one series.

I need to wait until it loads all results, change dash to edit panel mode, change panel´s multi-series mode to Yes
and then change back panel´s multi-series mode to NO.

Now i can see all series on the chat.

That´s happening with IE and Chrome.

Any1 seeing this ?

0 Karma

keerthana_k
Communicator

Thanks for your response. However, this is not working. Any other ideas?

0 Karma

aholzer
Motivator

You could add a where clause after your charting to ignore nulls

... | where NOT isnull()

This should exclude all null values from the results of your chart

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars this month. This ...

They're back! Join the SplunkTrust and MVP at .conf24

With our highly anticipated annual conference, .conf, comes the fez-wearers you can trust! The SplunkTrust, as ...

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...