Splunk Search

How can I remove or hide a column in a table?

travis_bear
Explorer

Here is my query; I'm trying not to have the "Total_Datapoints" column show up in the table since it has the same value for every row.

report=hw_use_by_jobs 
orig_host="myhost" |
chart 
   p50(PercentProcessorTime_max) as "p50 CPU", 
   stdev(PercentProcessorTime_max) as "CPU stdev",
   count as DataPoints
over ConcurrentTasks |
eventstats sum(DataPoints) as Total_DataPoints  |
eval "Percent of Time"=100*DataPoints/Total_DataPoints 

I've experimented with calculating the Total_Datapoints value before sending the results to the table, but this has not worked out and I'm not even sure if that's the right overall approach.

Tags (2)
1 Solution

ShaneNewman
Motivator

Pretty easy 🙂

At the very end:

| fields <list of fields you want to be displayed (no commas)>

View solution in original post

ShaneNewman
Motivator

Pretty easy 🙂

At the very end:

| fields <list of fields you want to be displayed (no commas)>

rafajot
Explorer

This solution is not going to work for stats where column names are dynamic, for example stats table produced by timechart. I would rather use ....|fields -column_name_to_exclude
BTW, the question is a duplicate of https://answers.splunk.com/answers/48466/remove-column-name-from-table-result.html

0 Karma

vicvaughan
Explorer

What about if you want a field hidden in the query, but you want to use those values in the drilldown?

ShaneNewman
Motivator

Not a problem!

0 Karma

travis_bear
Explorer

That worked! Thank you!

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...