Hello,
I have a value (imagine the value is the "something" that I wrote in the image) in a multiselect filter that I wanted to remove\hide, is there a way to do that?
So you have a field called PR_Tags, with a value of "PR_Tags"?
index= host= sourcetype=csv source=C:\\
| table PR_Tags
| where PR_Tags != "PR_Tags"
Don't put it there in the first place!
How do you populate the drop down? If it is from a search, simply exclude the value from the results of the search.
index= host= sourcetype=csv source=C:\\
| table PR_Tags
| eval PR_Tags=split(PR_Tags,",")
| mvexpand PR_Tags
| dedup PR_TagsThat's my search, it shouldn't be returning the term PR_Tags.
Saw the file that I'm using for the search, the only time that mentions PR_Tags in the csv is in the header. Is there a way to remove the header?
So you have a field called PR_Tags, with a value of "PR_Tags"?
index= host= sourcetype=csv source=C:\\
| table PR_Tags
| where PR_Tags != "PR_Tags"
It worked, thanks!