Splunk Search
Highlighted

How to remove a blank visualization table from my report and only keep the statistics table?

Explorer

I have this following search which gives me data, but i get a visualization table which is blank. I do not want this table in the report. Is there any way of removing this table?

eventtype=cppm-system-events  cphost=* | where category="Hotfixes Updates" |table _time, host, description, action_key
0 Karma
Highlighted

Re: How to remove a blank visualization table from my report and only keep the statistics table?

Explorer

I mean i dont want the visual data , statistics table i want .

0 Karma
Highlighted

Re: How to remove a blank visualization table from my report and only keep the statistics table?

Path Finder

Hi,
please explain well what you need.

0 Karma
Highlighted

Re: How to remove a blank visualization table from my report and only keep the statistics table?

Explorer

i just need to eliminate the visual table of x and y axis but i need the statistical data which i am getting by
his query.

0 Karma
Highlighted

Re: How to remove a blank visualization table from my report and only keep the statistics table?

Path Finder

why can you have the visual table of x and y axis? because you use the command |table the visualisation will be: Field name follow by the values

0 Karma
Highlighted

Re: How to remove a blank visualization table from my report and only keep the statistics table?

Explorer

Hi Thanks for your answer but i got it removed as when after modification , i tried o save the report there came an option for Visualization as first-> which was set by me e.g line and second -> None.

I selected None and the visual table was gone and i was left with the statistical data which i wanted.

View solution in original post

Highlighted

Re: How to remove a blank visualization table from my report and only keep the statistics table?

Motivator

try like this:
eventtype=cppm-system-events cphost=* | where category="Hotfixes Updates" |fields - time, host, description, actionkey | table *

or
eventtype=cppm-system-events cphost=* | where category="Hotfixes Updates" |fields + time, host, description, actionkey

to Keep thetime, host, description and actionkey fields, and display them in the order

0 Karma