Splunk Search

How to hide the table rows base on the string match

vinod743374
Communicator

Hi ,

I need a help in solving one of the issue, I have a table which is Shown below,

I just want to hide the rows with the name consisting of "Raju", also if we export this table to CSV , it should export all the results including the name "Raju"

Can any one Please help us to solve this.

Thankyou.




vinod743374_0-1644475587108.png

Labels (2)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

There are conflicting requirements here - csv export will export what is showing in the table

However, there are potentially a couple of ways you might approach it. One way would be to create a multi-value version of the fields where the name is Raju and then hide the second value. The problem with this is that you still see a row with no data, and the data is still not exported as csv, although if you export as JSON for example, you would still get the hidden data

    <panel depends="$STYLES$">
      <html>
        <style>
          #hideraju td div.multivalue-subcell[data-mv-index="1"] {
            display: none !important;
          }
        </style>
      </html>
    </panel>
    <panel id="hideraju">
      <table>
        <search>
          <query>
| makeresults count=6 
| eval name=mvindex(split("Vinod|Raju","|"),random()%2) 
| eval distance=mvindex(split("10KM|20KM","|"),random()%3) 
| eval city=mvindex(split("Vizag|Hyderabad","|"),random()%2)
| eval name=if(name="Raju",mvappend("",name),name)
| eval distance=if(name="Raju",mvappend("",distance),distance)
| eval city=if(name="Raju",mvappend("",city),city)
| table name distance city
          </query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">none</option>
      </table>
    </panel>

ITWhisperer_0-1644486334710.png

Another possibility is that you might be able to have say white text on a white background, if the name was Raju. I haven't tried this but would imagine that it would work in a similar manner in that a hidden multivalue would be added to each cell if the name was Raju and a style would be applied to change the text and background to the same colour.

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust

There are conflicting requirements here - csv export will export what is showing in the table

However, there are potentially a couple of ways you might approach it. One way would be to create a multi-value version of the fields where the name is Raju and then hide the second value. The problem with this is that you still see a row with no data, and the data is still not exported as csv, although if you export as JSON for example, you would still get the hidden data

    <panel depends="$STYLES$">
      <html>
        <style>
          #hideraju td div.multivalue-subcell[data-mv-index="1"] {
            display: none !important;
          }
        </style>
      </html>
    </panel>
    <panel id="hideraju">
      <table>
        <search>
          <query>
| makeresults count=6 
| eval name=mvindex(split("Vinod|Raju","|"),random()%2) 
| eval distance=mvindex(split("10KM|20KM","|"),random()%3) 
| eval city=mvindex(split("Vizag|Hyderabad","|"),random()%2)
| eval name=if(name="Raju",mvappend("",name),name)
| eval distance=if(name="Raju",mvappend("",distance),distance)
| eval city=if(name="Raju",mvappend("",city),city)
| table name distance city
          </query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">none</option>
      </table>
    </panel>

ITWhisperer_0-1644486334710.png

Another possibility is that you might be able to have say white text on a white background, if the name was Raju. I haven't tried this but would imagine that it would work in a similar manner in that a hidden multivalue would be added to each cell if the name was Raju and a style would be applied to change the text and background to the same colour.

Get Updates on the Splunk Community!

Accelerating Observability as Code with the Splunk AI Assistant

We’ve seen in previous posts what Observability as Code (OaC) is and how it’s now essential for managing ...

Integrating Splunk Search API and Quarto to Create Reproducible Investigation ...

 Splunk is More Than Just the Web Console For Digital Forensics and Incident Response (DFIR) practitioners, ...

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...