topic Re: remove specific columns from a table using a search command in Splunk Search

remove specific columns from a table using a search command

harshal_chakran — Mon, 28 Sep 2020 16:05:12 GMT

Hi,

I have written a search query in Advanced XML dashboard, which displays the table as follows,

parameter value_one value_two value_three value_four param1 1 2 3 4 param2 5 6 7 8 param3 9 10 11 12 param4 13 14 15 16

I want to show only some specific columns based on situations such as,

for situation 1:parameter value_three

for situation 2:parameter value_one

for situation 3:parameter ,value_three ,value_four,value_two

I know that putting " table parameter value_(any required value)" solves the problem. But is it possible to hide/remove columns using there column headers name OR is it possible to remove the first three or last three columns from the table using the search query itself.

Kindly help...!!!

Re: remove specific columns from a table using a search command

martin_mueller — Tue, 11 Mar 2014 13:25:15 GMT

Isn't calling table or fields exactly what you describe as the first solution, hide/remove columns using their column header names?

Re: remove specific columns from a table using a search command

somesoni2 — Tue, 11 Mar 2014 16:22:54 GMT

How do you define the situations? Is is a condition based on search result or a user input based on drop down or something?

Re: remove specific columns from a table using a search command

the_wolverine — Mon, 28 Sep 2020 16:09:52 GMT

I'm not sure why this question is so difficult. A column = field. So just state the columns that you want and/or state the columns that you do NOT want in your query:

situation 1: your search | fields + value_three
situation 2: your search | fields + value_one
situation 3: your search | fields + value_three, value_four, value_two
OR, your search | fields - value_one