My bar chart is built from this query:
index=$index$ namespace=$namespace$ host="*$host$*"
| timechart span=1h
eval(distinct_count(field1) - distinct_count(field2)) as "Re-processing"
count(eval(field3="entry" AND (field4="someValue" OR field4="someOtherValue"))) as "Input"
count(eval(field3="entry" AND (field4="object-notifications"))) as "Input2"
count(eval(executionStatus="FAILURE")) as "Failure"
| appendcols
[ search index=$index$ namespace=$namespace$ host="*$host$*" level=ERROR
| timechart span=1h
count(eval(like(log,"%Unhandled exception occurred%"))) as "Unhandled exceptions"
count(eval(like(log,"%These credentials do not authorize access%"))) as "Catalog Access Error"
count(eval(NOT like(log,"%Unhandled exception occurred%") AND NOT like(log,"%These credentials do not authorize access%"))) as "Errors" ]
I have a lot of series like "Input" and "Input2", so that the legend is so long I have two pages of it in a chart. I'd like to hide the series that are not shown in a current timespan on the chart from the legend. Curiously, another chart on the same dashboard is built from this:
index=$indexDas$ namespace=$namespaceDas$ host="$_env$-das-*"
event=PARTITION_COMPLETED
| timechart span=1h count by vendor
and it does that automatically. However, I can't eval all my series before timechart in the query in question, because there is eval(distinct_count(field1) - distinct_count(field2)) as "Re-processing" and appended columns. What would you suggest?