Splunk Search

how to filter out columns in a chart after using a lookup and addtotals

_jgpm_
Communicator

I lost all my previous text because I accidentally navigated away from the page so I'll be brief here. I'm using 6.4.3.

I used this pseudocode search command:

basicsearch | stats values(ID) by name | lookup file to extend chart | addtotals col=t fieldname=sum | foreach field [eval field_perc=calc a percentage]

This is where I'm stuck. I can't think of how to remove a column where the addtotals row = 0. My chart has 30 fields so I don't want to list them all. I've tried using

foreach field [ fields - if(does field==0, then field,otherwise null) ]

but it only erases the field itself, not the column.

I want to keep all the rows, but only reduce the columns down to the meaningful ones (i.e. nonzero columns).

I appreciate any suggestions. Thank you.

0 Karma
1 Solution

sundareshr
Legend

Add this to your query

... | untable name fields data | where fields="row" AND data=0 | xyseries name fields data

View solution in original post

sundareshr
Legend

Add this to your query

... | untable name fields data | where fields="row" AND data=0 | xyseries name fields data

_jgpm_
Communicator

@sundareshr Thanks for showing me how to use untable and xyseries. I definitely think I will use those in the future. However, the where logic doesn't work as expected. I started down the rabbit hole of researching logic tables...but this problem is a trivial one for me and I think I will just do an eval to create a mvfield of row labels where the row sum = 0. That's all I really need.

Thanks!

0 Karma
Get Updates on the Splunk Community!

Happy CX Day to our Community Superheroes!

Happy 10th Birthday CX Day!What is CX Day? It’s a global celebration recognizing innovation and success in the ...

Check out This Month’s Brand new Splunk Lantern Articles

Splunk Lantern is a customer success center providing advice from Splunk experts on valuable data insights, ...

Routing Data to Different Splunk Indexes in the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...