How do I hide rows based on the number of rows returned in a transaction?
(EDITED: removed all the contextual information as it wasn't needed)
Check the mvcount
of the field you're looking at. So in this case, you'd add a clause that says: | where mvcount(FIELD_VALUE)!=1
See http://docs.splunk.com/Documentation/Splunk/6.1.4/SearchReference/CommonEvalFunctions and check out the various mv*
functions you can use on multivalued fields.
Check the mvcount
of the field you're looking at. So in this case, you'd add a clause that says: | where mvcount(FIELD_VALUE)!=1
See http://docs.splunk.com/Documentation/Splunk/6.1.4/SearchReference/CommonEvalFunctions and check out the various mv*
functions you can use on multivalued fields.
Consider looking at the eventcount
field produced by the transaction
command as well.
@aweitzman beautiful as always; thanks! Especially appreciate how you give the relevant splunk doc links as well.