Splunk Search

How to hide the table rows base on the string match

vinod743374
Communicator

Hi ,

I need a help in solving one of the issue, I have a table which is Shown below,

I just want to hide the rows with the name consisting of "Raju", also if we export this table to CSV , it should export all the results including the name "Raju"

Can any one Please help us to solve this.

Thankyou.




vinod743374_0-1644475587108.png

Labels (2)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

There are conflicting requirements here - csv export will export what is showing in the table

However, there are potentially a couple of ways you might approach it. One way would be to create a multi-value version of the fields where the name is Raju and then hide the second value. The problem with this is that you still see a row with no data, and the data is still not exported as csv, although if you export as JSON for example, you would still get the hidden data

    <panel depends="$STYLES$">
      <html>
        <style>
          #hideraju td div.multivalue-subcell[data-mv-index="1"] {
            display: none !important;
          }
        </style>
      </html>
    </panel>
    <panel id="hideraju">
      <table>
        <search>
          <query>
| makeresults count=6 
| eval name=mvindex(split("Vinod|Raju","|"),random()%2) 
| eval distance=mvindex(split("10KM|20KM","|"),random()%3) 
| eval city=mvindex(split("Vizag|Hyderabad","|"),random()%2)
| eval name=if(name="Raju",mvappend("",name),name)
| eval distance=if(name="Raju",mvappend("",distance),distance)
| eval city=if(name="Raju",mvappend("",city),city)
| table name distance city
          </query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">none</option>
      </table>
    </panel>

ITWhisperer_0-1644486334710.png

Another possibility is that you might be able to have say white text on a white background, if the name was Raju. I haven't tried this but would imagine that it would work in a similar manner in that a hidden multivalue would be added to each cell if the name was Raju and a style would be applied to change the text and background to the same colour.

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust

There are conflicting requirements here - csv export will export what is showing in the table

However, there are potentially a couple of ways you might approach it. One way would be to create a multi-value version of the fields where the name is Raju and then hide the second value. The problem with this is that you still see a row with no data, and the data is still not exported as csv, although if you export as JSON for example, you would still get the hidden data

    <panel depends="$STYLES$">
      <html>
        <style>
          #hideraju td div.multivalue-subcell[data-mv-index="1"] {
            display: none !important;
          }
        </style>
      </html>
    </panel>
    <panel id="hideraju">
      <table>
        <search>
          <query>
| makeresults count=6 
| eval name=mvindex(split("Vinod|Raju","|"),random()%2) 
| eval distance=mvindex(split("10KM|20KM","|"),random()%3) 
| eval city=mvindex(split("Vizag|Hyderabad","|"),random()%2)
| eval name=if(name="Raju",mvappend("",name),name)
| eval distance=if(name="Raju",mvappend("",distance),distance)
| eval city=if(name="Raju",mvappend("",city),city)
| table name distance city
          </query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">none</option>
      </table>
    </panel>

ITWhisperer_0-1644486334710.png

Another possibility is that you might be able to have say white text on a white background, if the name was Raju. I haven't tried this but would imagine that it would work in a similar manner in that a hidden multivalue would be added to each cell if the name was Raju and a style would be applied to change the text and background to the same colour.

Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Painting a Clearer Picture: Creating Cross-Domain Visibility with AI Canvas

    Thursday, June 25, 2026  |  11AM PDT / 2PM EDT  Duration: 1 Hour (Includes live Q&A) Register to ...

Analytics Workspace deprecation

As of Splunk Cloud Platform 10.4.2604 and Splunk Enterprise 10.4, Analytics Workspace is now deprecated. ...

Splunk Developer Day Recap: Building, Publishing, and Growing on the Splunk Platform

Splunk Developer Day brought the Splunk developer community together for a practical look at what it means to ...