https://community.splunk.com/t5/Splunk-Dev/remove-unwanted-records-from-output/m-p/686196#M11456 <P>Expected Output:</P><P>Ticket ID&nbsp; &nbsp;Priority&nbsp; &nbsp;Status</P><P>1234&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;P1&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Closed</P><P>5678</P><P>&nbsp;</P><P>8765&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; P2&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Closed</P> Thu, 02 May 2024 16:36:15 GMT avi123 2024-05-02T16:36:15Z https://community.splunk.com/t5/Splunk-Dev/remove-unwanted-records-from-output/m-p/686196#M11456 <P>Expected Output:</P><P>Ticket ID&nbsp; &nbsp;Priority&nbsp; &nbsp;Status</P><P>1234&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;P1&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Closed</P><P>5678</P><P>&nbsp;</P><P>8765&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; P2&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Closed</P> Thu, 02 May 2024 16:36:15 GMT https://community.splunk.com/t5/Splunk-Dev/remove-unwanted-records-from-output/m-p/686196#M11456 avi123 2024-05-02T16:36:15Z https://community.splunk.com/t5/Splunk-Dev/remove-unwanted-records-from-output/m-p/686199#M11457 <P>It would be better to give us some more context - its helps with trying to help and answer you question.<BR /><BR />I guess you are trying to remove / filter out some data?<BR /><BR />This is just guessing on what you maybe wanting to do.<BR /><BR />This is an example using make results, this filters the ticket_id=5678 (so apply same princples for your code)&nbsp;<BR /><BR /></P> <LI-CODE lang="markup">| makeresults | eval _raw="ticket_id, priority,status 123,P1,Closed 5678,, 8765,P2,Closed" | multikv forceheader=1 | search ticket_id!=5678 | table ticket_id, priority, status</LI-CODE> Thu, 02 May 2024 23:35:41 GMT https://community.splunk.com/t5/Splunk-Dev/remove-unwanted-records-from-output/m-p/686199#M11457 deepakc 2024-05-02T23:35:41Z