Splunk Search

How to hide a column in a table, but use the hidden field in the chart for a report?

nagendra008
Explorer

Hello experts,

I have a case where I need to show a field in a table, but I need to hide it in the chart.

Search:

index = ..... my search | stats ..... by field_1| eval field_1 = "Hello"| eval field_4  = "Hello\nHow are you"| table field_1, field_2, field_3

Table:

          field_1        field_2    field_3
      1:  Hello          foo        jjoooo
          How are you                 
      2:  Hello          malware    jhon
          How are you                 

Issues: When try to use the field_1 in the bar chart, I see the value as empty because of a long string.

I wasn't able to create a new field ( field_4) with previous value of field_1 and show it on the chart, but not in the table. The chart in the report takes input from the table. I need to hide the field_1 column in the table and want to display the field_4 in the bar chart.

Note: I faced the same issue in the dashboard. I used fields tag in the xml to hide.

Any help is appreciated.

Regards,
Nagee.

0 Karma

iKate
Builder

First answer here shows how to do what you need, without CSS https://answers.splunk.com/answers/204419/do-this-in-simple-xml.html

0 Karma

meenal901
Communicator

You can use CSS for the table. Include the CSS in your dashboard. See the code below, modify as per your requirement

td:nth-child(4) {
  display: none
}
0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...