Getting Data In

how to avoid displaying the field which contains #?

Builder

Hi have a field named acts which displays all the different acts with below query

base search | table acts

which displays as below

displayed screen
113;screen

kjhkh;jkh

hjgjh#kjhk
jhgjhyg#

Now I dont want to display any of the results which contains # in it. How can I filter them?

0 Karma
1 Solution

SplunkTrust
SplunkTrust

Try like this

base search | table acts | eval acts=mvfilter(NOT match(acts,"#"))

View solution in original post

0 Karma

SplunkTrust
SplunkTrust

If acts is one of your extracted fields you can filter the same in the base search itself

<Your Base Search> acts!="*#*"
| table acts
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

SplunkTrust
SplunkTrust

Here's one way.

base search | regex acts!="#" | table acts
---
If this reply helps you, an upvote would be appreciated.
0 Karma

SplunkTrust
SplunkTrust

Try like this

base search | table acts | eval acts=mvfilter(NOT match(acts,"#"))

View solution in original post

0 Karma