topic Re: Only display rows in table if it contains value in Splunk Search

Only display rows in table if it contains value

606866581 — Fri, 28 Jun 2013 15:06:53 GMT

Hi Splunkers, I've been struggling to find what should be an easy solution...

I have a table with many columns, one of the headers is: server_load.

I only want to display a row, if server_load > 80.

Any advice is much appreciated, Thanks

Re: Only display rows in table if it contains value

aholzer — Mon, 28 Sep 2020 14:12:19 GMT

Pipe your base search into a where or search command with server_load > 80.

<base search> | where server_load > 80 | table <your fields>

You don't even need the where clause if your server_load is an original field from the events. In which case you can simply add "server_load > 80" as part of your base search.

<base search> server_load > 80 | table <your fields>

Re: Only display rows in table if it contains value

606866581 — Fri, 28 Jun 2013 15:29:17 GMT

Brilliant, I'll note this one down for future use.
Thanks a bunch!

Re: Only display rows in table if it contains value

linu1988 — Fri, 28 Jun 2013 15:33:58 GMT

Isn't it easy to just apply where condition server_load>80 in your search query? Am i not getting something!! Kindly explain.