I have search results like this:
Host---------------Description------------ EventSize
127.0.0.1----------Prod DB---------------- 90
127.0.0.2----------Trade Service---------- 34
I need remove "Description" field from visualization (for chart like "EventSize by Host"), but don't remove this field from search results. How can i do that?
Thanks.
UPD.
It isn't dashboard, so it haven't SIMPLE XML. I use this search for my report:
|inputlookup Source_description #add CSV lookup with Descriptions
|fields Host Description
|join
[search index=_internal source=*license_usage.log type="Usage"
|stats sum(b) as b by h
|eval TotalSizeMB=if(len(b)=0 OR isnull (b), "0.00", round (b/1024/1024,2))
|fields h, TotyalSizeMB
|rename h AS Host ]
|fields Host Description ToyalSizeMB
|sort 5 - TotalSizeMB
And i have this statistics and visualization tabs like this:
You can see that description field useless in chart, but usefull in statistics table.
I can use comand like this: " |eval Host=Host." - ".Description |fields - Description " to merge 2 fields, but it isn't the best solution, because it becomes difficult to read Host field.
So, how can i remove this field from chart, but save it in statistics search?
... View more