topic disappearing NULL-columns when sorting a table in Splunk Dev

disappearing NULL-columns when sorting a table

bjoernjensen — Wed, 08 Mar 2017 09:48:43 GMT

Hey everyone,

I have an issues with a table that has an empty column:

index=_internal
| head 10
| table _time host "my field"

Using Splunk 6.5.2 this results in a table with three columns: _time, host and my field.

When I click on any column header for sorting the column my field disappears.

Even fillnull does not work as I expected:

index=_internal
| head 10
| table _time host "my field" 
| fillnull value="some value"

There is no filling, and sorting will make the column my field disappear, again.

What is working, but is clunky since I will have 15+ fields that might change some time in future:

index=_internal
| head 10
| table _time host "my field" 
| fillnull value="" "my field"

In my case I am actually using an eval prior in order to calculate the my field value. Since the source field is rarely present, the result is mostly NULL. As if I was doing this:

index=_internal
| head 10
| eval "my field"=null()
| table _time host "my field"
| fillnull value=""

(same problem)

I hope I just missed something obvious.

All the best,
Björn

Re: disappearing NULL-columns when sorting a table

gcusello — Wed, 08 Mar 2017 10:11:36 GMT

hi bjoernjensen,
did you tried to assign a zero value when "my field" is null inserting something like this before your table command?

| eval "my field" = if(isnull("my field"),0,"my field")

bye.
Giuseppe

Re: disappearing NULL-columns when sorting a table

bjoernjensen — Wed, 08 Mar 2017 15:14:39 GMT

Hey Giuseppe,

I certainly could fix each field (table column) with this odd behaviour using fillnull value="" <FIELD_1> <FIELD_2> ... <FIELD_n>. But I need something more universal. Like the default behaviour of fillnull:

field-list
Description: ... If not specified, fillnull is applied to all fields.

source: https://docs.splunk.com/Documentation/Splunk/6.5.2/SearchReference/Fillnull

Do I have to file a bug here?

Re: disappearing NULL-columns when sorting a table

gcusello — Wed, 08 Mar 2017 15:19:35 GMT

Probably.
Open a case on Partner Portal, this Will be useful For all splunkers.
Bye.
Giuseppe

Re: disappearing NULL-columns when sorting a table

somesoni2 — Wed, 08 Mar 2017 15:19:52 GMT

Can you try these

index=_internal  | head 10  | table _time host "my field" 
| fillnull value="" *

index=_internal  | head 10  | table _time host "my field" 
| foreach * [eval "<<FIELD>>"=coalesce('<<FIELD>>',"")]

Re: disappearing NULL-columns when sorting a table

bjoernjensen — Wed, 08 Mar 2017 15:24:13 GMT

Hey,

thanks for the feedback.

the first one results in two an additional column named *, which does not disappear if sorted. my field does disappear though

the second one results in a table where my fieldstill disappears

Re: disappearing NULL-columns when sorting a table

bjoernjensen — Wed, 08 Mar 2017 15:33:12 GMT

Due to feedback from slack this behaviour is only showing in 6.5.2. Not in 6.5.1 nor in 6.4.2.

Re: disappearing NULL-columns when sorting a table

woodcock — Tue, 29 Sep 2020 13:11:29 GMT

Like this (field names with spaces are E*V*I*L😞

index=_internal
| head 10
| eval "my field"=if(isnull("my field"), "some value", 'my field')
| table _time host "my field"