Splunk Search

How to remove a blank visualization table from my report and only keep the statistics table?

mehtas
Explorer

I have this following search which gives me data, but i get a visualization table which is blank. I do not want this table in the report. Is there any way of removing this table?

eventtype=cppm-system-events  cphost=* | where category="Hotfixes Updates" |table _time, host, description, action_key
0 Karma
1 Solution

mehtas
Explorer

Hi Thanks for your answer but i got it removed as when after modification , i tried o save the report there came an option for Visualization as first-> which was set by me e.g line and second -> None.

I selected None and the visual table was gone and i was left with the statistical data which i wanted.

View solution in original post

fdi01
Motivator

try like this:
eventtype=cppm-system-events cphost=* | where category="Hotfixes Updates" |fields - _time, host, description, action_key | table *

or
eventtype=cppm-system-events cphost=* | where category="Hotfixes Updates" |fields + _time, host, description, action_key

to Keep the_time, host, description and action_key fields, and display them in the order

0 Karma

mehtas
Explorer

Hi Thanks for your answer but i got it removed as when after modification , i tried o save the report there came an option for Visualization as first-> which was set by me e.g line and second -> None.

I selected None and the visual table was gone and i was left with the statistical data which i wanted.

Patient
Path Finder

why can you have the visual table of x and y axis? because you use the command |table the visualisation will be: Field name follow by the values

0 Karma

mehtas
Explorer

I mean i dont want the visual data , statistics table i want .

0 Karma

Patient
Path Finder

Hi,
please explain well what you need.

0 Karma

mehtas
Explorer

i just need to eliminate the visual table of x and y axis but i need the statistical data which i am getting by
his query.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...