I lost all my previous text because I accidentally navigated away from the page so I'll be brief here. I'm using 6.4.3.
I used this pseudocode search command:
basicsearch | stats values(ID) by name | lookup file to extend chart | addtotals col=t fieldname=sum | foreach field [eval field_perc=calc a percentage]
This is where I'm stuck. I can't think of how to remove a column where the addtotals row = 0. My chart has 30 fields so I don't want to list them all. I've tried using
foreach field [ fields - if(does field==0, then field,otherwise null) ]
but it only erases the field itself, not the column.
I want to keep all the rows, but only reduce the columns down to the meaningful ones (i.e. nonzero columns).
I appreciate any suggestions. Thank you.
Add this to your query
... | untable name fields data | where fields="row" AND data=0 | xyseries name fields data
Add this to your query
... | untable name fields data | where fields="row" AND data=0 | xyseries name fields data
@sundareshr Thanks for showing me how to use untable and xyseries. I definitely think I will use those in the future. However, the where logic doesn't work as expected. I started down the rabbit hole of researching logic tables...but this problem is a trivial one for me and I think I will just do an eval to create a mvfield of row labels where the row sum = 0. That's all I really need.
Thanks!