https://community.splunk.com/t5/Splunk-Search/Remove-null-values-from-evaluated-field-in-the-search-results/m-p/410869#M118562 <P>Hello, I have this query:<BR /> index=main | table sourcetype, data, context, local_endpoint, remote_endpoint<BR /> | eval Ergebnis = replace(data,"^[^\@]+","")<BR /> | search Ergebnis=*</P> <P>I Need to remove the empty rows from Ergebnis field that does not have a value but it does not work!</P> <P>thanks for Help <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span> </P> Wed, 30 Sep 2020 00:07:15 GMT anasshsa 2020-09-30T00:07:15Z https://community.splunk.com/t5/Splunk-Search/Remove-null-values-from-evaluated-field-in-the-search-results/m-p/410869#M118562 <P>Hello, I have this query:<BR /> index=main | table sourcetype, data, context, local_endpoint, remote_endpoint<BR /> | eval Ergebnis = replace(data,"^[^\@]+","")<BR /> | search Ergebnis=*</P> <P>I Need to remove the empty rows from Ergebnis field that does not have a value but it does not work!</P> <P>thanks for Help <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span> </P> Wed, 30 Sep 2020 00:07:15 GMT https://community.splunk.com/t5/Splunk-Search/Remove-null-values-from-evaluated-field-in-the-search-results/m-p/410869#M118562 anasshsa 2020-09-30T00:07:15Z https://community.splunk.com/t5/Splunk-Search/Remove-null-values-from-evaluated-field-in-the-search-results/m-p/410870#M118563 <P>can you try :</P> <P><CODE>| fillnull value=NULL Ergebnis | search NOT Ergebnis=NULL</CODE></P> <P>If this does not work, pls share sample input event and the output which you are getting. Also, put your query in <CODE>101010</CODE> sample code format. Thank you.</P> Thu, 18 Apr 2019 13:54:12 GMT https://community.splunk.com/t5/Splunk-Search/Remove-null-values-from-evaluated-field-in-the-search-results/m-p/410870#M118563 mayurr98 2019-04-18T13:54:12Z https://community.splunk.com/t5/Splunk-Search/Remove-null-values-from-evaluated-field-in-the-search-results/m-p/410871#M118564 <P>Hi</P> <P>Give a try</P> <PRE><CODE>index=main | table sourcetype, data, context, local_endpoint, remote_endpoint | eval Ergebnis = replace(data,"^[^\@]+","") | search Ergebnis !="" </CODE></PRE> Thu, 18 Apr 2019 13:55:43 GMT https://community.splunk.com/t5/Splunk-Search/Remove-null-values-from-evaluated-field-in-the-search-results/m-p/410871#M118564 vnravikumar 2019-04-18T13:55:43Z