Splunk Search

how to filter out columns in a chart after using a lookup and addtotals

_jgpm_
Communicator

I lost all my previous text because I accidentally navigated away from the page so I'll be brief here. I'm using 6.4.3.

I used this pseudocode search command:

basicsearch | stats values(ID) by name | lookup file to extend chart | addtotals col=t fieldname=sum | foreach field [eval field_perc=calc a percentage]

This is where I'm stuck. I can't think of how to remove a column where the addtotals row = 0. My chart has 30 fields so I don't want to list them all. I've tried using

foreach field [ fields - if(does field==0, then field,otherwise null) ]

but it only erases the field itself, not the column.

I want to keep all the rows, but only reduce the columns down to the meaningful ones (i.e. nonzero columns).

I appreciate any suggestions. Thank you.

0 Karma
1 Solution

sundareshr
Legend

Add this to your query

... | untable name fields data | where fields="row" AND data=0 | xyseries name fields data

View solution in original post

sundareshr
Legend

Add this to your query

... | untable name fields data | where fields="row" AND data=0 | xyseries name fields data

_jgpm_
Communicator

@sundareshr Thanks for showing me how to use untable and xyseries. I definitely think I will use those in the future. However, the where logic doesn't work as expected. I started down the rabbit hole of researching logic tables...but this problem is a trivial one for me and I think I will just do an eval to create a mvfield of row labels where the row sum = 0. That's all I really need.

Thanks!

0 Karma
Get Updates on the Splunk Community!

Splunk Education - Fast Start Program!

Welcome to Splunk Education! Splunk training programs are designed to enable you to get started quickly and ...

Five Subtly Different Ways of Adding Manual Instrumentation in Java

You can find the code of this example on GitHub here. Please feel free to star the repository to keep in ...

New Splunk APM Enhancements Help Troubleshoot Your MySQL and NoSQL Databases Faster

Splunk Observability has two new enhancements to make it quicker and easier to troubleshoot slow or frequently ...