How to show fields conditionally in search?

[djoobbani]

Dear Splunk Community:

I have the following search query:

<Basic_Search> | chart count by path_template, http_status_code | addtotals fieldname=total
| foreach 2* 3* 4* 5* [ eval "percent_<<FIELD>>"=round(100*'<<FIELD>>'/total,2),
"<<FIELD>>"=if('<<FIELD>>'=0 , '<<FIELD>>', '<<FIELD>>'." (".'percent_<<FIELD>>'."%)")] | fields - percent_* total 2* 3* 4*

Attached is the screen result of the above query which shows the 500s columns.

I need to modify the above search so that it only displays the numbers where the percentage is great than 0.01%. How do i do that?

Thanks!

[bowesmana · Accepted solution]

Change the foreach statement to do this

    [ eval "percent_<<FIELD>>"=round(100*'<<FIELD>>'/total,2),
        "<<FIELD>>"=case('<<FIELD>>'=0 , '<<FIELD>>', 'percent_<<FIELD>>'>0.01, '<<FIELD>>'." (".'percent_<<FIELD>>'."%)", true(), null())] 

i.e the percentage threshold of 0.01 or above will allow the value to be shown, otherwise it will clear it

[djoobbani]

Thank you!

[djoobbani]

You rock, thanks this works!