Splunk Search

How to hide the table rows base on the string match

vinod743374
Communicator

Hi ,

I need a help in solving one of the issue, I have a table which is Shown below,

I just want to hide the rows with the name consisting of "Raju", also if we export this table to CSV , it should export all the results including the name "Raju"

Can any one Please help us to solve this.

Thankyou.




vinod743374_0-1644475587108.png

Labels (2)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

There are conflicting requirements here - csv export will export what is showing in the table

However, there are potentially a couple of ways you might approach it. One way would be to create a multi-value version of the fields where the name is Raju and then hide the second value. The problem with this is that you still see a row with no data, and the data is still not exported as csv, although if you export as JSON for example, you would still get the hidden data

    <panel depends="$STYLES$">
      <html>
        <style>
          #hideraju td div.multivalue-subcell[data-mv-index="1"] {
            display: none !important;
          }
        </style>
      </html>
    </panel>
    <panel id="hideraju">
      <table>
        <search>
          <query>
| makeresults count=6 
| eval name=mvindex(split("Vinod|Raju","|"),random()%2) 
| eval distance=mvindex(split("10KM|20KM","|"),random()%3) 
| eval city=mvindex(split("Vizag|Hyderabad","|"),random()%2)
| eval name=if(name="Raju",mvappend("",name),name)
| eval distance=if(name="Raju",mvappend("",distance),distance)
| eval city=if(name="Raju",mvappend("",city),city)
| table name distance city
          </query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">none</option>
      </table>
    </panel>

ITWhisperer_0-1644486334710.png

Another possibility is that you might be able to have say white text on a white background, if the name was Raju. I haven't tried this but would imagine that it would work in a similar manner in that a hidden multivalue would be added to each cell if the name was Raju and a style would be applied to change the text and background to the same colour.

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust

There are conflicting requirements here - csv export will export what is showing in the table

However, there are potentially a couple of ways you might approach it. One way would be to create a multi-value version of the fields where the name is Raju and then hide the second value. The problem with this is that you still see a row with no data, and the data is still not exported as csv, although if you export as JSON for example, you would still get the hidden data

    <panel depends="$STYLES$">
      <html>
        <style>
          #hideraju td div.multivalue-subcell[data-mv-index="1"] {
            display: none !important;
          }
        </style>
      </html>
    </panel>
    <panel id="hideraju">
      <table>
        <search>
          <query>
| makeresults count=6 
| eval name=mvindex(split("Vinod|Raju","|"),random()%2) 
| eval distance=mvindex(split("10KM|20KM","|"),random()%3) 
| eval city=mvindex(split("Vizag|Hyderabad","|"),random()%2)
| eval name=if(name="Raju",mvappend("",name),name)
| eval distance=if(name="Raju",mvappend("",distance),distance)
| eval city=if(name="Raju",mvappend("",city),city)
| table name distance city
          </query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">none</option>
      </table>
    </panel>

ITWhisperer_0-1644486334710.png

Another possibility is that you might be able to have say white text on a white background, if the name was Raju. I haven't tried this but would imagine that it would work in a similar manner in that a hidden multivalue would be added to each cell if the name was Raju and a style would be applied to change the text and background to the same colour.

Get Updates on the Splunk Community!

Reduce and Transform Your Firewall Data with Splunk Data Management

Managing high-volume firewall data has always been a challenge. Noisy events and verbose traffic logs often ...

Automatic Discovery Part 1: What is Automatic Discovery in Splunk Observability Cloud ...

If you’ve ever deployed a new database cluster, spun up a caching layer, or added a load balancer, you know it ...

Real-Time Fraud Detection: How Splunk Dashboards Protect Financial Institutions

Financial fraud isn't slowing down. If anything, it's getting more sophisticated. Account takeovers, credit ...