topic Re: How do I remove a null field? in Splunk Search

How do I remove a null field?

tlagatta_splunk — Wed, 11 Feb 2015 09:19:59 GMT

Sometimes Splunk has extra null fields floating around (e.g., after fields nosuchfield *). Is there a command which automatically removes fields which have only null values?

Re: How do I remove a null field?

tlagatta_splunk — Wed, 11 Feb 2015 09:20:36 GMT

Using fields - nosuchfield is not satisfactory, since I might not know what the null field names are in advance.

Re: How do I remove a null field?

tlagatta_splunk — Sat, 21 Mar 2015 01:48:59 GMT

@skawasaki_splunk provided a good answer to How to only display fields with values in a table, which I adapted to my situation.

If your records have a unique Id field, then the following snippet removes null fields:
| stats values(*) as * by Id
The reason is that "stats values won't show fields that don't have at least one non-null value".

If your records don't have a unique Id field, then you should create one first using streamstats:
| streamstats count as Id | stats values(*) as * by Id

(Warning: if your data has multivalued lists, then stats values will remove duplicates and sort lexicographically.)

Re: How do I remove a null field?

hogan24 — Fri, 29 May 2015 14:50:53 GMT

I had a similar issue where I was trying to display the data in a 2 column/multi-row format so I did this:

| table datafield1 datafield2 datafield3 datafield4 datafield5 ...
| transpose
| rename column as Data "row 1" as Value
| where Value NOT NULL

This gives me the ability to put in as many fields as I want (which visually is very wide), flip it (| transpose) to only give me 2 columns, and remove every row with no data (| where). Hope this helps. Thanks.