topic Re: How do I hide rows if a field matches a certain value? in Splunk Search

How do I hide rows if a field matches a certain value?

jiaqya — Mon, 15 Oct 2018 14:46:40 GMT

i have 2 columns , one which has install status and the other which has the exception status.
install status has yes/no AND exception status has "exception/no"

if i find "exception" in this field, then i would like to hide all rows which contains that field=exception.

is this possible?

the pattern match value is coming from a drill down input. So if a user clicks on "Exception", i still need to show that, so cannot use the !="exception".

Re: How do I hide rows if a field matches a certain value?

kmorris_splunk — Mon, 15 Oct 2018 15:14:58 GMT

Assuming you are extracting that field already, you can just filter that out in your base search. For example:

index=YOUR_INDEX sourcetype=YOUR_SOURCETYPE YOUR_FIELD!="exception" |
table _time YOUR_FIELD ANOTHER_FIELD

Making assumptions on your search in general, but that would be the easiest way.

Re: How do I hide rows if a field matches a certain value?

jiaqya — Mon, 15 Oct 2018 15:38:12 GMT

Morris, thanks for your response.

the pattern match value is coming from an drilldown input.
so if user clicks on "Exception" i still need to show that, so cannot use the !="exception".

i am not able to explain the scenario here , but ill try.
i have 2 columns , one which has install status and the other which has the exception status.
install status has yes/no AND exception status has "exception/no"

so if input value is yes, i get all the yes, irrespective of exception status, bcoz yes means installed, so thats ok
if input values is exception, then irrespective of install status, it will show exception, this is also ok
now problem i have is with "no", if install status is "no" and exception status is "exception", then i would like to exclude the exception systems out of "no" click report.

so i was looking at some solution , which after the report output can exclude exception="exception" rows in case "install status"="no"

hope the problem is explained..
sorry for long write up.

Re: How do I hide rows if a field matches a certain value?

jiaqya — Tue, 16 Oct 2018 05:30:25 GMT

Think this can be done with search not, can any of you provide me a syntax where in i can do a search not when a column value=matches a pattern. thanks.

Re: How do I hide rows if a field matches a certain value?

jiaqya — Tue, 16 Oct 2018 07:10:33 GMT

Got this fixed by adding below code.

|eval mytext = if((Name ="No" AND Exception="Exception" ), "ExcludeThisRecord","NoNeedToExclude")
|search NOT mytext="ExcludeThisRecord"