topic Re: remove column name from |table result in Splunk Search

remove column name from |table result

Chubbybunny — Fri, 18 May 2012 23:46:54 GMT

I have a search that provides a table result:

host="host1" index="main" | head 1 | table index host

Is it possible to remove or ommit the column name from the result?

I've tried:

host="host1" index="main" | head 1 | rename host AS NULL, index AS NULL | table NULL NULL

any carrots for the Chubbybunny?

(\__/)
(='.'=)
(")_(")

Re: remove column name from |table result

dshpritz — Sat, 19 May 2012 00:56:11 GMT

You should be able to use the fields command:

http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/fields

So to omit the "carrots" field:

host="host1" index="main" | head 1 | table index host | fields - carrots

HTH

Dave

Re: remove column name from |table result

lguinn2 — Sat, 19 May 2012 22:22:14 GMT

That will omit the field AND the header. I think the bunny just wants to omit the header.

Re: remove column name from |table result

lguinn2 — Sat, 19 May 2012 22:29:33 GMT

This is a kludge, but it might work.

host="host1" index="main" | head 1 | 
fields - _raw _time |
fields + host index |
rename host AS " ", index AS "   "

When this search runs, I think that the Table view button will show you what you want. It will still have a header area, but it should be blank.

I think there are easier ways, though, if you want to put this in a dashboard....

Re: remove column name from |table result

jbsplunk — Wed, 30 May 2012 18:23:49 GMT

Don't ask for a field if you just plan to exclude it. I've tried to do this, and, AFAIK, there isn't a way to do this successfully. You'll always end up with a header, and presuming you're trying to export these results into something else, you'll end up with trouble. Just duplicate the search and leave the field off, save yourself a headache on the other side of things.

Re: remove column name from |table result

atulod1 — Tue, 29 Sep 2020 19:41:05 GMT

if ever 2 data in one field and they are Domain_Name = Domestic_Dev and Domain_Name = Domestic_QA I want to remove the Domain_Name =Domestic_QA