topic Re: how will i filter rows with specific column specification in Dashboards & Visualizations

how will i filter rows with specific column specification

kavyatim — Mon, 28 Sep 2020 15:57:01 GMT

Hi ,

I have a table called "Database" with column like this :
COD_SC_CSO
51681
11680
11680
11268
11251
I would like to filter rows only where COD_SC_CSO 2 and 3 position is 68. .
For example if COD_SC_CSO =51681(2 and 3 position is 68), i want to filter entire row of COD_SC_CSO =51681

Can any one help me out to do this.

Thanking

Re: how will i filter rows with specific column specification

cmeinco — Fri, 21 Feb 2014 05:38:05 GMT

Is this a splunk search question? Or are you asking how to only index the filtered data ?

Re: how will i filter rows with specific column specification

kavyatim — Mon, 28 Sep 2020 15:57:04 GMT

Its a splunk search question:

For time being my query is as follows:
source="base_bds_adsl.csv" | eval str=substr(COD_SC_CSO,3,2) | table str,N_BD,data_ini,data_fim,cd_enc,ESCRITORIO,AREA, NUMERO_TERMINAL,CNL,id_atlz,COD_SC_CSO, DDD,Sigla| where str="68

but i dont want to display str in my table

Re: how will i filter rows with specific column specification

Ayn — Fri, 21 Feb 2014 06:02:49 GMT

Well, you almost got the answer yourself, you just need to reorder your search a bit.

source="base_bds_adsl.csv" | eval str=substr(COD_SC_CSO,3,2) | search str=68 | table N_BD,data_ini,data_fim,cd_enc,ESCRITORIO,AREA, NUMERO_TERMINAL,CNL,id_atlz,COD_SC_CSO, DDD,Sigla

Re: how will i filter rows with specific column specification

cmeinco — Mon, 28 Sep 2020 15:57:34 GMT

I'm not sure which is more efficient, but since my brain works in regex, this would also work:

source="base_bds_adsl.csv" | regex COD_SC_CSO="^\d{2}68\d$" | table N_BD,data_ini,data_fim,cd_enc,ESCRITORIO,AREA, NUMERO_TERMINAL,CNL,id_atlz,COD_SC_CSO, DDD,Sigla

Re: how will i filter rows with specific column specification

dwaddle — Sat, 22 Feb 2014 13:07:32 GMT

You are not entirely clear by "filter" if you mean to "keep" or to "throw away" the items with the substring of '68'.

Don't forget, the where command can do almost anything eval can do, but can do comparisons as well. So this should work as well:

source="base_bds_adsl.csv" | where  (substr(COD_SC_CSO,3,2)=68)