https://community.splunk.com/t5/Splunk-Search/how-to-filter-out-columns-in-a-chart-after-using-a-lookup-and/m-p/252852#M75670 <P>@sundareshr Thanks for showing me how to use untable and xyseries. I definitely think I will use those in the future. However, the where logic doesn't work as expected. I started down the rabbit hole of researching logic tables...but this problem is a trivial one for me and I think I will just do an eval to create a mvfield of row labels where the row sum = 0. That's all I really need. </P> <P>Thanks!</P> Fri, 02 Dec 2016 15:34:05 GMT _jgpm_ 2016-12-02T15:34:05Z https://community.splunk.com/t5/Splunk-Search/how-to-filter-out-columns-in-a-chart-after-using-a-lookup-and/m-p/252850#M75668 <P>I lost all my previous text because I accidentally navigated away from the page so I'll be brief here. I'm using 6.4.3.</P> <P>I used this pseudocode search command:</P> <P><CODE>basicsearch | stats values(ID) by name | lookup file to extend chart | addtotals col=t fieldname=sum | foreach field [eval field_perc=calc a percentage] </CODE></P> <P>This is where I'm stuck. I can't think of how to remove a column where the addtotals row = 0. My chart has 30 fields so I don't want to list them all. I've tried using</P> <P><CODE> foreach field [ fields - if(does field==0, then field,otherwise null) ] </CODE></P> <P>but it only erases the field itself, not the column. </P> <P>I want to keep all the rows, but only reduce the columns down to the meaningful ones (i.e. nonzero columns).</P> <P>I appreciate any suggestions. Thank you. </P> Thu, 01 Dec 2016 20:32:01 GMT https://community.splunk.com/t5/Splunk-Search/how-to-filter-out-columns-in-a-chart-after-using-a-lookup-and/m-p/252850#M75668 _jgpm_ 2016-12-01T20:32:01Z https://community.splunk.com/t5/Splunk-Search/how-to-filter-out-columns-in-a-chart-after-using-a-lookup-and/m-p/252851#M75669 <P>Add this to your query</P> <PRE><CODE>... | untable name fields data | where fields="row" AND data=0 | xyseries name fields data </CODE></PRE> Thu, 01 Dec 2016 20:39:33 GMT https://community.splunk.com/t5/Splunk-Search/how-to-filter-out-columns-in-a-chart-after-using-a-lookup-and/m-p/252851#M75669 sundareshr 2016-12-01T20:39:33Z https://community.splunk.com/t5/Splunk-Search/how-to-filter-out-columns-in-a-chart-after-using-a-lookup-and/m-p/252852#M75670 <P>@sundareshr Thanks for showing me how to use untable and xyseries. I definitely think I will use those in the future. However, the where logic doesn't work as expected. I started down the rabbit hole of researching logic tables...but this problem is a trivial one for me and I think I will just do an eval to create a mvfield of row labels where the row sum = 0. That's all I really need. </P> <P>Thanks!</P> Fri, 02 Dec 2016 15:34:05 GMT https://community.splunk.com/t5/Splunk-Search/how-to-filter-out-columns-in-a-chart-after-using-a-lookup-and/m-p/252852#M75670 _jgpm_ 2016-12-02T15:34:05Z