https://community.splunk.com/t5/Splunk-Search/How-to-hide-rows-based-on-the-number-of-rows-returned-from-a/m-p/168249#M47973 <P>@aweitzman beautiful as always; thanks! Especially appreciate how you give the relevant splunk doc links as well.</P> Wed, 15 Oct 2014 15:52:17 GMT sjanwity 2014-10-15T15:52:17Z https://community.splunk.com/t5/Splunk-Search/How-to-hide-rows-based-on-the-number-of-rows-returned-from-a/m-p/168247#M47971 <P>How do I hide rows based on the number of rows returned in a transaction?</P> <P>(EDITED: removed all the contextual information as it wasn't needed)</P> Wed, 15 Oct 2014 15:33:22 GMT https://community.splunk.com/t5/Splunk-Search/How-to-hide-rows-based-on-the-number-of-rows-returned-from-a/m-p/168247#M47971 sjanwity 2014-10-15T15:33:22Z https://community.splunk.com/t5/Splunk-Search/How-to-hide-rows-based-on-the-number-of-rows-returned-from-a/m-p/168248#M47972 <P>Check the <CODE>mvcount</CODE> of the field you're looking at. So in this case, you'd add a clause that says: <CODE>| where mvcount(FIELD_VALUE)!=1</CODE></P> <P>See <A href="http://docs.splunk.com/Documentation/Splunk/6.1.4/SearchReference/CommonEvalFunctions">http://docs.splunk.com/Documentation/Splunk/6.1.4/SearchReference/CommonEvalFunctions</A> and check out the various <CODE>mv*</CODE> functions you can use on multivalued fields.</P> Wed, 15 Oct 2014 15:37:54 GMT https://community.splunk.com/t5/Splunk-Search/How-to-hide-rows-based-on-the-number-of-rows-returned-from-a/m-p/168248#M47972 aweitzman 2014-10-15T15:37:54Z https://community.splunk.com/t5/Splunk-Search/How-to-hide-rows-based-on-the-number-of-rows-returned-from-a/m-p/168249#M47973 <P>@aweitzman beautiful as always; thanks! Especially appreciate how you give the relevant splunk doc links as well.</P> Wed, 15 Oct 2014 15:52:17 GMT https://community.splunk.com/t5/Splunk-Search/How-to-hide-rows-based-on-the-number-of-rows-returned-from-a/m-p/168249#M47973 sjanwity 2014-10-15T15:52:17Z https://community.splunk.com/t5/Splunk-Search/How-to-hide-rows-based-on-the-number-of-rows-returned-from-a/m-p/168250#M47974 <P>Consider looking at the <CODE>eventcount</CODE> field produced by the <CODE>transaction</CODE> command as well.</P> Wed, 15 Oct 2014 19:46:39 GMT https://community.splunk.com/t5/Splunk-Search/How-to-hide-rows-based-on-the-number-of-rows-returned-from-a/m-p/168250#M47974 martin_mueller 2014-10-15T19:46:39Z