Splunk Search

How to hide the table rows base on the string match

vinod743374
Communicator

Hi ,

I need a help in solving one of the issue, I have a table which is Shown below,

I just want to hide the rows with the name consisting of "Raju", also if we export this table to CSV , it should export all the results including the name "Raju"

Can any one Please help us to solve this.

Thankyou.




vinod743374_0-1644475587108.png

Labels (2)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

There are conflicting requirements here - csv export will export what is showing in the table

However, there are potentially a couple of ways you might approach it. One way would be to create a multi-value version of the fields where the name is Raju and then hide the second value. The problem with this is that you still see a row with no data, and the data is still not exported as csv, although if you export as JSON for example, you would still get the hidden data

    <panel depends="$STYLES$">
      <html>
        <style>
          #hideraju td div.multivalue-subcell[data-mv-index="1"] {
            display: none !important;
          }
        </style>
      </html>
    </panel>
    <panel id="hideraju">
      <table>
        <search>
          <query>
| makeresults count=6 
| eval name=mvindex(split("Vinod|Raju","|"),random()%2) 
| eval distance=mvindex(split("10KM|20KM","|"),random()%3) 
| eval city=mvindex(split("Vizag|Hyderabad","|"),random()%2)
| eval name=if(name="Raju",mvappend("",name),name)
| eval distance=if(name="Raju",mvappend("",distance),distance)
| eval city=if(name="Raju",mvappend("",city),city)
| table name distance city
          </query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">none</option>
      </table>
    </panel>

ITWhisperer_0-1644486334710.png

Another possibility is that you might be able to have say white text on a white background, if the name was Raju. I haven't tried this but would imagine that it would work in a similar manner in that a hidden multivalue would be added to each cell if the name was Raju and a style would be applied to change the text and background to the same colour.

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust

There are conflicting requirements here - csv export will export what is showing in the table

However, there are potentially a couple of ways you might approach it. One way would be to create a multi-value version of the fields where the name is Raju and then hide the second value. The problem with this is that you still see a row with no data, and the data is still not exported as csv, although if you export as JSON for example, you would still get the hidden data

    <panel depends="$STYLES$">
      <html>
        <style>
          #hideraju td div.multivalue-subcell[data-mv-index="1"] {
            display: none !important;
          }
        </style>
      </html>
    </panel>
    <panel id="hideraju">
      <table>
        <search>
          <query>
| makeresults count=6 
| eval name=mvindex(split("Vinod|Raju","|"),random()%2) 
| eval distance=mvindex(split("10KM|20KM","|"),random()%3) 
| eval city=mvindex(split("Vizag|Hyderabad","|"),random()%2)
| eval name=if(name="Raju",mvappend("",name),name)
| eval distance=if(name="Raju",mvappend("",distance),distance)
| eval city=if(name="Raju",mvappend("",city),city)
| table name distance city
          </query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">none</option>
      </table>
    </panel>

ITWhisperer_0-1644486334710.png

Another possibility is that you might be able to have say white text on a white background, if the name was Raju. I haven't tried this but would imagine that it would work in a similar manner in that a hidden multivalue would be added to each cell if the name was Raju and a style would be applied to change the text and background to the same colour.

Get Updates on the Splunk Community!

New Release | Splunk Cloud Platform 10.1.2507

Hello Splunk Community!We are thrilled to announce the General Availability of Splunk Cloud Platform 10.1.2507 ...

🌟 From Audit Chaos to Clarity: Welcoming Audit Trail v2

&#x1f5e3; You Spoke, We Listened  Audit Trail v2 wasn’t written in isolation—it was shaped by your voices.  In ...

Splunk New Course Releases for a Changing World

Every day, the world feels like it’s moving faster with new technological breakthroughs, AI innovation, and ...