Are you a member of the Splunk Community?
- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- How can I remove or hide a column in a table?
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Here is my query; I'm trying not to have the "Total_Datapoints" column show up in the table since it has the same value for every row.
report=hw_use_by_jobs
orig_host="myhost" |
chart
p50(PercentProcessorTime_max) as "p50 CPU",
stdev(PercentProcessorTime_max) as "CPU stdev",
count as DataPoints
over ConcurrentTasks |
eventstats sum(DataPoints) as Total_DataPoints |
eval "Percent of Time"=100*DataPoints/Total_DataPoints
I've experimented with calculating the Total_Datapoints value before sending the results to the table, but this has not worked out and I'm not even sure if that's the right overall approach.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Pretty easy 🙂
At the very end:
| fields <list of fields you want to be displayed (no commas)>
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Pretty easy 🙂
At the very end:
| fields <list of fields you want to be displayed (no commas)>
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
This solution is not going to work for stats where column names are dynamic, for example stats table produced by timechart. I would rather use ....|fields -column_name_to_exclude
BTW, the question is a duplicate of https://answers.splunk.com/answers/48466/remove-column-name-from-table-result.html
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
What about if you want a field hidden in the query, but you want to use those values in the drilldown?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Not a problem!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
That worked! Thank you!
Take Action Automatically on Splunk Alerts with Red Hat Ansible Automation Platform
Calling All Security Pros: Ready to Race Through Boston?
Beyond Detection: How Splunk and Cisco Integrated Security Platforms Transform ...
