Hide values not visible in bar chart from the legend in Splunk dashboard

Viewed 10

My bar chart is built from this query:

index=$index$ namespace=$namespace$ host="*$host$*"
            | timechart span=1h
            eval(distinct_count(field1) - distinct_count(field2)) as "Re-processing"
            count(eval(field3="entry" AND (field4="someValue" OR field4="someOtherValue"))) as "Input"
            count(eval(field3="entry" AND (field4="object-notifications"))) as "Input2"
            count(eval(executionStatus="FAILURE")) as "Failure"
            | appendcols
                [ search index=$index$ namespace=$namespace$ host="*$host$*" level=ERROR
                  | timechart span=1h
                   count(eval(like(log,"%Unhandled exception occurred%"))) as "Unhandled exceptions"
                   count(eval(like(log,"%These credentials do not authorize access%"))) as "Catalog Access Error"
                   count(eval(NOT like(log,"%Unhandled exception occurred%") AND NOT like(log,"%These credentials do not authorize access%"))) as "Errors"                  ]

I have a lot of series like "Input" and "Input2", so that the legend is so long I have two pages of it in a chart. I'd like to hide the series that are not shown in a current timespan on the chart from the legend. Curiously, another chart on the same dashboard is built from this:

index=$indexDas$ namespace=$namespaceDas$ host="$_env$-das-*"
            event=PARTITION_COMPLETED
            | timechart span=1h count by vendor

and it does that automatically. However, I can't eval all my series before timechart in the query in question, because there is eval(distinct_count(field1) - distinct_count(field2)) as "Re-processing" and appended columns. What would you suggest?

0 Answers
Related