Splunk Search

How can I remove or hide a column in a table?

travis_bear
Explorer

Here is my query; I'm trying not to have the "Total_Datapoints" column show up in the table since it has the same value for every row.

report=hw_use_by_jobs 
orig_host="myhost" |
chart 
   p50(PercentProcessorTime_max) as "p50 CPU", 
   stdev(PercentProcessorTime_max) as "CPU stdev",
   count as DataPoints
over ConcurrentTasks |
eventstats sum(DataPoints) as Total_DataPoints  |
eval "Percent of Time"=100*DataPoints/Total_DataPoints 

I've experimented with calculating the Total_Datapoints value before sending the results to the table, but this has not worked out and I'm not even sure if that's the right overall approach.

Tags (2)
1 Solution

ShaneNewman
Motivator

Pretty easy 🙂

At the very end:

| fields <list of fields you want to be displayed (no commas)>

View solution in original post

ShaneNewman
Motivator

Pretty easy 🙂

At the very end:

| fields <list of fields you want to be displayed (no commas)>

rafajot
Explorer

This solution is not going to work for stats where column names are dynamic, for example stats table produced by timechart. I would rather use ....|fields -column_name_to_exclude
BTW, the question is a duplicate of https://answers.splunk.com/answers/48466/remove-column-name-from-table-result.html

0 Karma

vicvaughan
Explorer

What about if you want a field hidden in the query, but you want to use those values in the drilldown?

ShaneNewman
Motivator

Not a problem!

0 Karma

travis_bear
Explorer

That worked! Thank you!

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...