Splunk Search

How to remove a row in a table

kishan2356
Explorer

_time A B C D
6:05 1 1 5 8
6:10 0 3 2 2
6:15 5 0 6 2
6:20 8 9 2 7
6:25 9 2 4 5
6:30 6 7 2 8

Hi, I have a table in a dashboard where time is broken up into 5 min bins.
What I’m trying to do is eliminate all rows based on the value of a cell in a column.
In my case, if any value in column A (above table) equals 0 I want the whole row to not be displayed.
In the table above the row of 6:10 would be removed, and the table should be as follows:

_time A B C D
6:05 1 1 5 8
6:15 5 0 6 2
6:20 8 9 2 7
6:25 9 2 4 5
6:30 6 7 2 8

I’ve tried using | where clause but it did not work.
Is there a way to accomplish this?

Tags (5)
0 Karma

to4kawa
Ultra Champion
index=XX sourcetype=XX  (earliest=$earliestTime$ latest=$latestTime$) OR (earliest=$earliestTime1$ latest=$latestTime1$) OR (earliest=$earliestTime2$ latest=$latestTime2$) OR (earliest=$earliestTime3$ latest=$latestTime3$) OR (earliest=$earliestTime4$ latest=$latestTime4$)
| streamstats values(eval(strftime(_time,"%m%d"))) as label
| bin span=5m _time
| streamstats values(eval(strftime(_time,"%H:%M:%S"))) as time
| chart dc(ecn) over time by label
| where time!=$click.value$

What about this query?

You have to put "nothing" in $click.value$ in <init>

0 Karma

mayurr98
Super Champion

whats your search query?

0 Karma

kishan2356
Explorer

Below is the source code

XX

<input type="time" token="time_finder" searchWhenChanged="true">
  <label>Time Picker</label>
  <default>
    <earliest>@d</earliest>
    <latest>now</latest>
  </default>
  <change>
    <eval token="earliestTime">if(isstr(earliest), relative_time(now(),earliest),"-0d")</eval>
    <eval token="latestTime">if(isstr(latest), relative_time(now(),latest), "-0d")</eval>
    <eval token="earliestTime1">relative_time(earliestTime,"-7d")</eval>
    <eval token="latestTime1">relative_time(latestTime,"-7d")</eval>
    <eval token="earliestTime2">relative_time(earliestTime,"-14d")</eval>
    <eval token="latestTime2">relative_time(latestTime,"-14d")</eval>
    <eval token="earliestTime3">relative_time(earliestTime,"-21d")</eval>
    <eval token="latestTime3">relative_time(latestTime,"-21d")</eval>
    <eval token="earliestTime4">relative_time(earliestTime,"-28d")</eval>
    <eval token="latestTime4">relative_time(latestTime,"-28d")</eval>
  </change>
</input>


<panel>
  <title>XX</title>
  <table>
    <title></title>
    <search>
      <query>| multisearch 
[ search index=XX sourcetype=XX earliest=$earliestTime$ latest=$latestTime$ 
| eval label="XX"  
| fields -_raw _time ecn label ] 
[ search index=XX sourcetype=XX earliest=$earliestTime1$ latest=$latestTime1$ 
| eval _time=_time+60*60*24*7 
| eval label="XX" 
| fields -_raw _time ecn label ] 
[ search index=XX sourcetype=XX earliest=$earliestTime2$ latest=$latestTime2$ 
| eval _time=_time+60*60*24*14 
| eval label="XX" 
| fields -_raw _time ecn label ] 
[ search index=XX sourcetype=XX earliest=$earliestTime3$ latest=$latestTime3$ 
| eval _time=_time+60*60*24*21 
| eval label="XX" 
| fields -_raw _time ecn label ] 
[ search index=XX sourcetype=XX earliest=$earliestTime4$ latest=$latestTime4$ 
| eval _time=_time+60*60*24*28 
| eval label="XX" 
| fields -_raw _time ecn label] 

| bin _time span=5m
| chart dc(ecn) over _time by label
| eval ....
| eval ....
| eval ....
| eval ....
| eval ....
| fields ...
$time_finder.earliest$
$time_finder.latest$

10
none
progressbar
false

0


0


0


0
false


0


0


0


0


0


0
false


0


0


0


0


0 Karma

wmyersas
Builder

Presuming you have some search that generates your table ... try this:

index=ndx sourcetype=srctp A=* B=* C=* D=*
| bin _time span=5m
| stats sum(A) as A sum(B) as B sum(C) as C sum(D) as D by somefield
| search A>0

The | search A>0 will throw-out any events from the stats results that have a 0 (or less than 0) in the A column

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...