Timelion points "greater than count 0" condition

Elastic Stack Kibana
1

Hi, I need to visualize some points related to specific Windows events on Timelion, the problem is that there are so many points over 0.00:

This is the expression I've used:

.es(event_id:4624).points(radius=6).label("Session started")

How can I remove all those points in 0.00? I've tried with ".if(gt,0) surprisingly, it shows only points on 0.00

1 Like
2

It looks like setting a value to null will hide it from the chart.

So, using .if(lte, 0, null) should do the trick.

2 Likes
3

Thanks you so much. Ir works!

1 Like
4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.