Splunk Search

How do I hide a column in a table?

dgomonov
New Member

Imagine a scenario where I need to have a hidden column in my table to serve a passing functionality.

Example:

  1. I create a second column (let’s call it XYZ) with the appropriate whichever text (using replace, lower, etc) to be passed into URLs with $click.XYZ$
  2. I can use now 'condition.. ' inside of 'drill down' to specify that I actually want my first column ABC to be clickable ('field=ABC') and serve the passing functionality.
  3. How do I hide now second XYZ column? - Please be specific code wise how to do it

Thanks!

0 Karma

jpolvino
Builder

Just to make sure I understand, you have a dashboard panel with a stats table. The table has columns fieldA, fieldB, fieldC, fieldD and you want to use the value in fieldC, but not display that column in the stats table. This might be for a key you don't want to display, but use as part of a drilldown.

One way to do it:

  <table>
    <title>Your title here</title>
    <search>
      <query> (your search here) | table fieldA fieldB fieldC fieldD </query>
      <earliest>-1d@d</earliest>
      <latest>now</latest>
    </search>
    <option name="count">10</option>
    <option name="drilldown">row</option>
    <option name="rowNumbers">false</option>
    <fields>fieldA,fieldB,fieldD</fields>
    <drilldown>
      <set token="clientTok">$row.fieldC$</set>
      <set token="forms.clientTok">$row.fieldC$</set>
    </drilldown>
  </table>

The query should output all the fields you want to display, plus the one you want to hide. I just used table as an example, but you likely already have them listed by stats or something similar. The fields section controls fields that you want to see in the panel. The token clientTok can then be used in other panels, such as the target panel, using the $clientTok$.

Amiel_
Engager

Work perfectly !

0 Karma

hijacob
Communicator

Hi,

try this command...
| fields 'list of fields you want to be displayed'

Greetings,

Jacob

hijacob
Communicator

besides you can try
|fields - XYZ column

rdownie
Communicator

or
.... | fields - 'list of fields you want to exclude'

Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

SOK it to Me: Top 3 Benefits of Using Splunk Operator on Kubernetes that’ll Make ...

    Thursday, July 9, 2026  |  11:00AM–12:00PM PDT Duration: 1 hour (includes Q&A) Managing can feel like a ...

Upgrade Prep for 10.4, Network Observability Deep Dives, and More from Splunk Lantern

Splunk Lantern is Splunk’s customer success center that provides practical guidance from Splunk experts on key ...

Splunk Developer Day announcements: AI agents, MCP tools, Forecasting, and Custom ...

Splunk Developer Day was packed with product and platform updates for developers building in the AI ...