Remove column from table if

[matthaeus]

Hey there!

I'm quite new in Splunk an am struggeling again. What I'm trying to do is to hide a column if every field in that column has a certain value. I've already searched a lot online and found several solutions, that should work for me but don't.

Can anybody help me out here?

[to4kawa · Accepted solution]

sample:

| makeresults
| eval _raw="unit,col1,col2,col3,col4,col5
a,-1,-2,-1,-1,-1
b,-1,-2,-2,-1,0
c,0,-2,0,-2,-2
d,-2,-2,0,-2,0"
| multikv forceheader=1
| table unit,col1,col2,col3,col4,col5
| untable unit cols value
| eventstats dc(value) as check1 by cols
| where !(check1=1 AND value=-2)
| xyseries unit cols value

[matthaeus]

Works perfectly, thanks so much!

[thambisetty]

@to4kawa  answer works only for the data you posted, what if the values gets changed , lets say -2 becomes -3, every time you can't hardcode the value if you don't know the value exactly.

[thambisetty]

can you share some examples?

[matthaeus]

So I have Data like this:

	col1	col2	col3	col4	col5
a	-1	-2	-1	-1	-1
b	-1	-2	-2	-1	0
c	0	-2	0	-2	-2
d	-2	-2	0	-2	0

And what I want is, that column2 will not be displayed since all values in that column are "-2". 

[thambisetty]

I am using inputcsv and outputcsv. 

if you run below search that contains field town has same value.

| makeresults 
| eval state="AndhraPradesh,Karnataka,Tamilnadu" 
| makemv state delim="," 
| mvexpand state 
| table state 
| eval city=case(state="AndhraPradesh","Nellore,Vijayawada,Vizag",state="Karnataka","Bengaluru,Mysore",state="Tamilnadu","chennai") 
| makemv city delim="," 
| mvexpand city
| eval town="certain value"

and I have written these results to csv to make use of them in search which is used in fields command. The subsearch will take fields which have different values.

| makeresults 
| eval state="AndhraPradesh,Karnataka,Tamilnadu" 
| makemv state delim="," 
| mvexpand state 
| table state 
| eval city=case(state="AndhraPradesh","Nellore,Vijayawada,Vizag",state="Karnataka","Bengaluru,Mysore",state="Tamilnadu","chennai") 
| makemv city delim="," 
| mvexpand city
| eval town="certain value"
| outputcsv test.csv 
| fields [| inputcsv test.csv | stats dc(*) as * | transpose | where 'row 1' > 1 | table column | stats values(column) as search delim="," | table search]