Splunk Search

hide calculated field from dashbaord

surekhasplunk
Communicator

Hi,

I have a calculated field call Percentage which is required for other calculations but i dont want that value to be shown in the dashbaord.

I tried table command without Percentage field name but that is still showing as Null% under that field.
I tried fields command with - Percentage but didn't work .

Tags (2)
0 Karma
1 Solution

niketn
Legend

@surekhasplunk, Simple XML Configuration <fields> can be used to hide Percent field by displaying all the other fields and excluding Percent. You can still use the default table drilldown token $row.Percent$ , if you want to pass on the clicked Percent value. Check out Simple XML Reference for table: https://docs.splunk.com/Documentation/Splunk/latest/Viz/PanelreferenceforSimplifiedXML#table

<table>
    <search>
        <query>
              <YourBaseSearch>
              | table field1 field2 field3 Percentage
        </query>
    </search>
    <fields>field1,field2,field3</fields>
    <drilldown>
         <set token="tokPercent">$row.Percent$</set>
    </drilldown>
</table>
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

0 Karma

niketn
Legend

@surekhasplunk, Simple XML Configuration <fields> can be used to hide Percent field by displaying all the other fields and excluding Percent. You can still use the default table drilldown token $row.Percent$ , if you want to pass on the clicked Percent value. Check out Simple XML Reference for table: https://docs.splunk.com/Documentation/Splunk/latest/Viz/PanelreferenceforSimplifiedXML#table

<table>
    <search>
        <query>
              <YourBaseSearch>
              | table field1 field2 field3 Percentage
        </query>
    </search>
    <fields>field1,field2,field3</fields>
    <drilldown>
         <set token="tokPercent">$row.Percent$</set>
    </drilldown>
</table>
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

surekhasplunk
Communicator

Thanks @niketnilay it worked by adding tag with my fields in that omitting the percentage field.

Thanks a lot ... cheers

0 Karma

niketn
Legend

Yay! Glad it worked.... Happy Weekend 🙂

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

somesoni2
Revered Legend

Could you share your search here? In ideal situation, both of the things that you tried should've worked.

0 Karma

elliotproebstel
Champion

Is it possible that your dashboard has a <fields> tag in the XML specifying that the Percentage field should be shown?

0 Karma
Get Updates on the Splunk Community!

Tech Talk Recap | Mastering Threat Hunting

Mastering Threat HuntingDive into the world of threat hunting, exploring the key differences between ...

Observability for AI Applications: Troubleshooting Latency

If you’re working with proprietary company data, you’re probably going to have a locally hosted LLM or many ...

Splunk AI Assistant for SPL vs. ChatGPT: Which One is Better?

In the age of AI, every tool promises to make our lives easier. From summarizing content to writing code, ...