I want to dynamically remove a number of columns/headers from my stats.
So my thinking is to use a wild card on the left of the comparison operator.
But this does not work
... | where "P-CSCF*">4
Sample Output: Say for example I just wanted to remove the columns P-CSCF-02 & P-CSCF-06 and have P-CSCF-05 and P-CSCF-07 showing. I would like to do it with something like ... | where "P-CSCF*">1 for example. I could use fields + option but that is static I want something dynamic.
_time P-CSCF-02 P-CSCF-05 P-CSCF-06 P-CSCF-07
2017-11-27T18:30:00.000+1300 1 2 0 6
2017-11-27T18:35:00.000+1300 0 2 0 6
2017-11-27T18:40:00.000+1300 0 2 0 6
EDIT1
This is my Desired Output with only 2 columns showing, the others omitted because they do not have any values > 1:
_time P-CSCF-05 P-CSCF-07
2017-11-27T18:30:00.000+1300 2 6
2017-11-27T18:35:00.000+1300 2 6
2017-11-27T18:40:00.000+1300 2 6
Should I be using something like ... | WHERE like(source,"/logs/%/camel-audit.log")]
Not what I want but this is wildcarding on the RHS of the comparison operator ...|search version=*10_2*
