topic Re: Time chart command, how to remove unwanted row base on condition of column data in Splunk Search

How to remove unwanted row base on condition of column data?

324981 — Tue, 05 Jul 2022 16:07:41 GMT

Hi, I am new in Splunk,

if I want to remove the display of all column field for T9_LotID_LaneA,T9_LotID_LaneB,T9_LotIB_LaneC,T9_LotID_LaneD, was empty or null value

my base search:

the results:

please advise ,

Thanks

Re: Time chart command, how to remove unwanted row base on condition of column data

324981 — Fri, 24 Jun 2022 03:30:21 GMT

below is the column field that I want to filter:

(((ID = "T9_LotID_LaneA" AND Value >0 AND Value!="03_Dummy")) OR ((ID = "T9_LotID_LaneB" AND Value >0 AND Value!="03_Dummy")) OR ((ID = "T9_LotID_LaneC" AND Value >0 AND Value!="03_Dummy")) OR ((ID = "T9_LotID_LaneD" AND Value >0 AND Value!="03_Dummy")))

Re: Time chart command, how to remove unwanted row base on condition of column data

ITWhisperer — Fri, 24 Jun 2022 05:37:57 GMT

Try something like this

OWA03 AND ID = "T9 Hot DI Air Temp.(Upper Chamber) HTC5.1 PV" OR ID = "T9 Hot DI Humidity PV" OR ID = "T9 Hot DI N2 Diffuser Temp.HTC4.1 PV" OR ID = "T9 Hot DI Water Process Temp.HTC2.1 PV" OR ID = "T9_LotID_LaneA" OR ID = "T9_LotID_LaneB" OR ID = "T9_LotID_LaneC" OR ID = "T9_LotID_LaneD" |timechart span=3s cont=false latest(Value) by ID | where (T9_LotID_LaneA >0 AND T9_LotID_LaneA !="03_Dummy") OR (T9_LotID_LaneB >0 AND T9_LotID_LaneB !="03_Dummy") OR (T9_LotID_LaneC >0 AND T9_LotID_LaneC !="03_Dummy") OR (T9_LotID_LaneD >0 AND T9_LotID_LaneD !="03_Dummy")

Re: Time chart command, how to remove unwanted row base on condition of column data

324981 — Mon, 27 Jun 2022 01:48:53 GMT

Hi ITWhisperer,

Thank you for your help.

the result : show empty. but after I change from >0 to >" 0" it show the results. What does it mean from >0 to >"0" is it for integer value and string value ?

OWA03 AND ID = "T9 Hot DI Air Temp.(Upper Chamber) HTC5.1 PV" OR ID = "T9 Hot DI Humidity PV" OR ID = "T9 Hot DI N2 Diffuser Temp.HTC4.1 PV" OR ID = "T9 Hot DI Water Process Temp.HTC2.1 PV" OR ID = "T9_LotID_LaneA" OR ID = "T9_LotID_LaneB" OR ID = "T9_LotID_LaneC" OR ID = "T9_LotID_LaneD"
|timechart span=3s cont=false latest(Value) by ID
| where (T9_LotID_LaneA >"0" AND T9_LotID_LaneA !="03_Dummy") OR (T9_LotID_LaneB >"0" AND ID.T9_LotID_LaneB !="03_Dummy") OR (T9_LotID_LaneC >"0" AND T9_LotID_LaneC !="03_Dummy") OR (T9_LotID_LaneD >"0" AND T9_LotID_LaneD !="03_Dummy")

Re: Time chart command, how to remove unwanted row base on condition of column data

ITWhisperer — Fri, 01 Jul 2022 06:01:52 GMT

Yes, these fields hold non-numerics (strings) so comparing to "0" makes more sense although perhaps using != "" would be more appropriate?

Re: Time chart command, how to remove unwanted row base on condition of column data

324981 — Mon, 04 Jul 2022 00:37:08 GMT

it work well now. Thanks for the help.