Splunk Search

How to hide the table rows base on the string match

vinod743374
Communicator

Hi ,

I need a help in solving one of the issue, I have a table which is Shown below,

I just want to hide the rows with the name consisting of "Raju", also if we export this table to CSV , it should export all the results including the name "Raju"

Can any one Please help us to solve this.

Thankyou.




vinod743374_0-1644475587108.png

Labels (2)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

There are conflicting requirements here - csv export will export what is showing in the table

However, there are potentially a couple of ways you might approach it. One way would be to create a multi-value version of the fields where the name is Raju and then hide the second value. The problem with this is that you still see a row with no data, and the data is still not exported as csv, although if you export as JSON for example, you would still get the hidden data

    <panel depends="$STYLES$">
      <html>
        <style>
          #hideraju td div.multivalue-subcell[data-mv-index="1"] {
            display: none !important;
          }
        </style>
      </html>
    </panel>
    <panel id="hideraju">
      <table>
        <search>
          <query>
| makeresults count=6 
| eval name=mvindex(split("Vinod|Raju","|"),random()%2) 
| eval distance=mvindex(split("10KM|20KM","|"),random()%3) 
| eval city=mvindex(split("Vizag|Hyderabad","|"),random()%2)
| eval name=if(name="Raju",mvappend("",name),name)
| eval distance=if(name="Raju",mvappend("",distance),distance)
| eval city=if(name="Raju",mvappend("",city),city)
| table name distance city
          </query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">none</option>
      </table>
    </panel>

ITWhisperer_0-1644486334710.png

Another possibility is that you might be able to have say white text on a white background, if the name was Raju. I haven't tried this but would imagine that it would work in a similar manner in that a hidden multivalue would be added to each cell if the name was Raju and a style would be applied to change the text and background to the same colour.

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust

There are conflicting requirements here - csv export will export what is showing in the table

However, there are potentially a couple of ways you might approach it. One way would be to create a multi-value version of the fields where the name is Raju and then hide the second value. The problem with this is that you still see a row with no data, and the data is still not exported as csv, although if you export as JSON for example, you would still get the hidden data

    <panel depends="$STYLES$">
      <html>
        <style>
          #hideraju td div.multivalue-subcell[data-mv-index="1"] {
            display: none !important;
          }
        </style>
      </html>
    </panel>
    <panel id="hideraju">
      <table>
        <search>
          <query>
| makeresults count=6 
| eval name=mvindex(split("Vinod|Raju","|"),random()%2) 
| eval distance=mvindex(split("10KM|20KM","|"),random()%3) 
| eval city=mvindex(split("Vizag|Hyderabad","|"),random()%2)
| eval name=if(name="Raju",mvappend("",name),name)
| eval distance=if(name="Raju",mvappend("",distance),distance)
| eval city=if(name="Raju",mvappend("",city),city)
| table name distance city
          </query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">none</option>
      </table>
    </panel>

ITWhisperer_0-1644486334710.png

Another possibility is that you might be able to have say white text on a white background, if the name was Raju. I haven't tried this but would imagine that it would work in a similar manner in that a hidden multivalue would be added to each cell if the name was Raju and a style would be applied to change the text and background to the same colour.

Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Character substitutions with Regular Expressions

This challenge was first posted on Slack #puzzles channelFor BORE at .conf23, we had a puzzle question which ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...

[Puzzles] Solve, Learn, Repeat: Matching cron expressions

This puzzle (first published here) is based on matching timestamps to cron expressions.All the timestamps ...