Splunk Search
Highlighted

How to hide rows based on the number of rows returned from a transaction search?

Communicator

How do I hide rows based on the number of rows returned in a transaction?

(EDITED: removed all the contextual information as it wasn't needed)

Highlighted

Re: How to hide rows based on the number of rows returned from a transaction search?

Motivator

Check the mvcount of the field you're looking at. So in this case, you'd add a clause that says: | where mvcount(FIELD_VALUE)!=1

See http://docs.splunk.com/Documentation/Splunk/6.1.4/SearchReference/CommonEvalFunctions and check out the various mv* functions you can use on multivalued fields.

View solution in original post

Highlighted

Re: How to hide rows based on the number of rows returned from a transaction search?

Communicator

@aweitzman beautiful as always; thanks! Especially appreciate how you give the relevant splunk doc links as well.

Highlighted

Re: How to hide rows based on the number of rows returned from a transaction search?

SplunkTrust
SplunkTrust

Consider looking at the eventcount field produced by the transaction command as well.

0 Karma