topic Re: How to remove specified values of a field from a table? in Splunk Search

How to remove specified values of a field from a table?

ganinurceski — Wed, 30 Sep 2020 03:19:23 GMT

Hello there!
I need some help. I have a table, and in that table, there are are a "SHORT_ID", "DATA1 -> ERROR" & "DATA2 -> NO_ERROR" Row. Now I want to remove all results, where the DATA1 Field has a value of 0, zero.

The String look like this...
index= tag= DATA="000000108000000400000058" OR "000000198000000400000000000*" | rex field=DATA "(?P"000000108000000400000058")" | rex field=DATA "(?P"000000198000000400000000")" | chart count by SHORT_ID, ERROR | rename 000000108000000400000058 as ERROR | sort - ERROR | rename NULL as NO_ERROR*

I want to remove every Value of NO_ERROR which has zero in it.
I hope the question is clear 🙂
Thx for response

Re: How to remove specified values of a field from a table?

kamlesh_vaghela — Fri, 13 Dec 2019 12:30:29 GMT

@ganinurceski

Can you please share some sample data & expected output?

Re: How to remove specified values of a field from a table?

richgalloway — Fri, 13 Dec 2019 12:53:02 GMT

If I understand the question correctly, you need to add | where ERROR!=0 to the end of your query.

Re: How to remove specified values of a field from a table?

ganinurceski — Fri, 13 Dec 2019 13:17:01 GMT

Thx for response!
I've added | search NOT ERROR="0" and it worked!