topic Re: help to remove an empty line in Splunk Search

help to remove an empty line

jip31 — Mon, 18 Feb 2019 10:34:11 GMT

I use the request below
sometimes I have only value for Free_Space and sometimes only value for TotalSpace instead both
I need a way to don't dispalay the result (in table) if one of these 2 fields is NULL
Could you help ME please??

(eventtype="TotalSpace" OR ( eventtype="DiskHealthSize" AND Value<15)) 
| eval time = strftime(_time, "%m/%d/%Y %H:%M") 
| eval Value = round(Value, 1). " %" 
| eval TotalSpace = TotalSpaceKB/1024 
| eval TotalSpace = round(TotalSpace/1024,1). " GB" 
| stats latest(Value) as Free_Space latest(TotalSpace) as TotalSpace by host 
| sort +Free_Space limit=10

Thanks

Re: help to remove an empty line

vnravikumar — Mon, 18 Feb 2019 10:42:39 GMT

Hi @jip31

Try like

your query...
|search Value=* AND TotalSpace=*
| stats latest(Value) as Free_Space latest(TotalSpace) as TotalSpace by host 
 | sort +Free_Space limit=10

Re: help to remove an empty line

jip31 — Mon, 18 Feb 2019 16:20:50 GMT

Hi
Thanks but i am not sure that * is the better day? I try with fillnull but i dont succeed

Re: help to remove an empty line

Vijeta — Mon, 18 Feb 2019 16:59:48 GMT

can you share your events ?

Re: help to remove an empty line

vnravikumar — Mon, 18 Feb 2019 17:02:25 GMT

Or try with |where Value !="" AND TotalSpace !=""

Re: help to remove an empty line

vnravikumar — Mon, 18 Feb 2019 17:07:24 GMT

or |where isnotnull(Value ) AND isnotnull(TotalSpace )

Re: help to remove an empty line

vnravikumar — Tue, 19 Feb 2019 14:30:57 GMT

@jip31 have you tried?

Re: help to remove an empty line

jip31 — Tue, 19 Feb 2019 15:29:51 GMT

yes many thanks