How do I turn a report with 4 columns into a dashboard with only 2 columns?

[viji261992]

I have a report with 4 columns in that I have to create a dashboard with only using 2 columns please help

[niketn]

[UPDATED ANSWER] Based on updated details seems like removal of field is required in a chat visualization not table. You can try either one of the following (however, the percent value will not be available for further drilldown):

Option 1) use | fields - percent in the search that refers to your report i.e.

    <search ref="Your Report with Three Columns">| fields - percent</search>

Option 2) use chart configuration charting.data.fieldHideList to hide unwanted field

<option name="charting.data.fieldHideList">percent</option>

---

@viji261992, if you have a report that produces four columns i.e. field1, field2, field3 and field4, you can add following Simple XML table option to show only two required fields i.e. field1 and field2:

<fields>field1,field2</fields>

Refer to Simple XML reference for Splunk table: https://docs.splunk.com/Documentation/Splunk/latest/Viz/PanelreferenceforSimplifiedXML#table

[viji261992]

Hi Niketnilay,

index=opennms sourcetype=events | top limit=10 eventuei is the query I am running which is giving me the result in 3 columns like eventuei, count, percentage. In this I want only 2 columns (eventuei and count ) to be displayed in my dashboard.
I need eventuei in the x-axis (with the uei names displayed) and y-axis should be count.
Please help.

[viji261992]

I tried the below command
| fields - percent
i am getting error as "error in 'search' command:Unable to parse the search:Comparator'<' is missing a term on the left hand side.

[niketn]

refer to my updated answer with couple of options since your question is related to char and not table as expected from your original question.

[paulbannister]

Hi There,

Might need a few more details on this, are you look to join fields together to making the 4 columns into 2 or omit 2 columns completely?

[viji261992]

I want to omit 2 columns completely