topic Re: Customize table- How to display the output in a table format? in Splunk Enterprise

Customize table- How to display the output in a table format?

Vani_26 — Thu, 03 Nov 2022 20:15:37 GMT

I want to display the output in a table format.

Basically I have a list of responses values fields that I want to printout, but only if they have something in them.
I don't want to routinely display 10 extra fields that are usually with empty.

Re: Customize table- How to display the output in a table format?

richgalloway — Thu, 03 Nov 2022 21:33:40 GMT

Can you be more specific about your use case, please?

Tables will display a field (column) if told to display it - even if that field is null or doesn't exist. You can use a wildcard to display all available fields, but will have to eliminate some built-in fields first.

... ```Adjust this line to remove any other unwanted fields``` | fields - punct splunk_server* linecount | table _time *

Re: Customize table- How to display the output in a table format?

Vani_26 — Thu, 03 Nov 2022 22:52:13 GMT

Can you be more specific about your use case, please?

i have query where i am getting the count for success, error, failure , total_count etc , So, when i search my query for 24 hrs, Depends on the logs, sometimes i will not have data for failure, sometimes for error and so on...
So, when i make these fields as |table sucess error failure total_count , all these fields should not get displayed, only the fields which contains data should get displayed.

Tables will display a field (column) if told to display it - even if that field is null or doesn't exist.---Yes correct

You can use a wildcard to display all available fields, but will have to eliminate some built-in fields first.--how to do that

Re: Customize table- How to display the output in a table format?

richgalloway — Fri, 04 Nov 2022 00:05:56 GMT

You can use a wildcard to display all available fields, but will have to eliminate some built-in fields first.--how to do that

I gave an example of how to do that. Here's another one.

... | fields - _* | fields success, error, failure , total_count | table *

Re: Customize table- How to display the output in a table format?

Vani_26 — Fri, 04 Nov 2022 01:37:18 GMT

thank you, it worked