Splunk Search

Is it possible to hide, suppress or remove the column header row in a report?

Gawker
Path Finder

I have a report that looks similar to this:

alt text

Is it possible to hide, suppress or remove the column header row in the report so that it looks like this:

alt text

I want to do this in the actual report, not in a dashboard.

BYA, this is not the solution: https://answers.splunk.com/answers/76860/is-it-possible-to-remove-coulumn-names.html

Thank you.

0 Karma

niketn
Legend

@Gawker, can you try the following Run anywhere Search? The commands from first | makeresults till | table Location Data_Age generate dummy data similar to your question.

The query uses two transpose commands to make a row of Table Data as Column Header. In this case Germany. To ensure Germany is always present in the result dummy row with 0 Age has been appended to the results.

| makeresults 
| fields - _time 
| eval data="Location=Germany,Data_Age=3;Location=Switzerland,Data_Age=2000;Location=USA,Data_Age=1000;Location=USAHQ,Data_Age=200;" 
| makemv delim=";" data 
| mvexpand data 
| rename data as _raw 
| KV 
| table Location Data_Age
| sort Location
| append 
    [| makeresults 
    | fields - _time 
    | eval Location="Germany", Data_Age=0]
| dedup Location    
| transpose header_field=Location column_name=Location 
| transpose header_field=Germany column_name=Germany 
| search Germany!="Location"

Since the logic behind this approach is to use Table Row data as Table Header, the formatting of the Row will be same as Table Header and the same can not be overridden.

If this does not cater to your needs, can you please describe the need for Report and not Dashboard?

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

cpetterborg
SplunkTrust
SplunkTrust

Try:

<your_base_search_in_all_its_glory> 
| rename <Location> as " " 
| rename <Data_Age> as "  " 

It may not exactly NOT have column names, but they will at least be invisible.

Gawker
Path Finder

Thank you for the info. I already tried that, but it looks a little odd having the blank row at the top when it's embedded in a web page. I was hoping that Splunk had some easy option to hide/unhide the column names (ex: table hideheader=y Location, Data_Age

Maybe they'll consider it an enhancement : )

0 Karma

woodcock
Esteemed Legend

This is the only option.

0 Karma
Get Updates on the Splunk Community!

Threat Hunting Unlocked: How to Uplevel Your Threat Hunting With the PEAK Framework ...

WATCH NOWAs AI starts tackling low level alerts, it's more critical than ever to uplevel your threat hunting ...

Splunk APM: New Product Features + Community Office Hours Recap!

Howdy Splunk Community! Over the past few months, we’ve had a lot going on in the world of Splunk Application ...

Index This | Forward, I’m heavy; backward, I’m not. What am I?

April 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...