topic Re: How to make a table containing columns with non-empty values (or other criteria) from non-indexed data? in Splunk Search https://community.splunk.com/t5/Splunk-Search/How-to-make-a-table-containing-columns-with-non-empty-values-or/m-p/188710#M54374 <P>Nice one!!</P> Wed, 29 Oct 2014 20:58:11 GMT somesoni2 2014-10-29T20:58:11Z How to make a table containing columns with non-empty values (or other criteria) from non-indexed data? https://community.splunk.com/t5/Splunk-Search/How-to-make-a-table-containing-columns-with-non-empty-values-or/m-p/188707#M54371 <P>I'm doing this REST call to query the system for modular inputs:</P> <PRE><CODE>| rest /services/data/modular-inputs | table title description </CODE></PRE> <P>Before running this through the table command, the output was extremely wide because of the way this particular data has fields broken out. My ideal end goal is something like "make me a table of arbitrary REST command output but only include fields which are in <EM>every</EM> event". I started thinking how to do this with the metadata command when I realized that there is no index metadata to query as this data isn't indexed. Now, I'm out of ideas. TIA</P> Wed, 29 Oct 2014 20:00:37 GMT https://community.splunk.com/t5/Splunk-Search/How-to-make-a-table-containing-columns-with-non-empty-values-or/m-p/188707#M54371 halr9000 2014-10-29T20:00:37Z Re: How to make a table containing columns with non-empty values (or other criteria) from non-indexed data? https://community.splunk.com/t5/Splunk-Search/How-to-make-a-table-containing-columns-with-non-empty-values-or/m-p/188708#M54372 <P>Mildly hacky, but it works:</P> <PRE><CODE>| rest /services/data/modular-inputs | fillnull value="ยง%&amp;$&amp;ZH$%%" | untable id field value | eventstats count(eval(isnull(value) OR trim(value)="" OR value="ยง%&amp;$&amp;ZH$%%")) as nulls by field | where nulls=0 | xyseries id field value </CODE></PRE> Wed, 29 Oct 2014 20:40:36 GMT https://community.splunk.com/t5/Splunk-Search/How-to-make-a-table-containing-columns-with-non-empty-values-or/m-p/188708#M54372 martin_mueller 2014-10-29T20:40:36Z Re: How to make a table containing columns with non-empty values (or other criteria) from non-indexed data? https://community.splunk.com/t5/Splunk-Search/How-to-make-a-table-containing-columns-with-non-empty-values-or/m-p/188709#M54373 <P>One more workaround</P> <PRE><CODE>| rest /services/data/modular-inputs | table [| rest /services/data/modular-inputs | fieldsummary maxvals=1| eventstats max(count) as max | where count=max | table field | eval field=field."," | mvcombine field | nomv field | rename field as search] </CODE></PRE> Wed, 29 Oct 2014 20:57:31 GMT https://community.splunk.com/t5/Splunk-Search/How-to-make-a-table-containing-columns-with-non-empty-values-or/m-p/188709#M54373 somesoni2 2014-10-29T20:57:31Z Re: How to make a table containing columns with non-empty values (or other criteria) from non-indexed data? https://community.splunk.com/t5/Splunk-Search/How-to-make-a-table-containing-columns-with-non-empty-values-or/m-p/188710#M54374 <P>Nice one!!</P> Wed, 29 Oct 2014 20:58:11 GMT https://community.splunk.com/t5/Splunk-Search/How-to-make-a-table-containing-columns-with-non-empty-values-or/m-p/188710#M54374 somesoni2 2014-10-29T20:58:11Z Re: How to make a table containing columns with non-empty values (or other criteria) from non-indexed data? https://community.splunk.com/t5/Splunk-Search/How-to-make-a-table-containing-columns-with-non-empty-values-or/m-p/188711#M54375 <P>Not sure which to pick! <span class="lia-unicode-emoji" title=":slightly_smiling_face:">๐Ÿ™‚</span></P> Wed, 29 Oct 2014 21:23:29 GMT https://community.splunk.com/t5/Splunk-Search/How-to-make-a-table-containing-columns-with-non-empty-values-or/m-p/188711#M54375 halr9000 2014-10-29T21:23:29Z Re: How to make a table containing columns with non-empty values (or other criteria) from non-indexed data? https://community.splunk.com/t5/Splunk-Search/How-to-make-a-table-containing-columns-with-non-empty-values-or/m-p/188712#M54376 <P>The one that doesn't need to cheat with a subsearch of course <span class="lia-unicode-emoji" title=":face_with_tongue:">๐Ÿ˜›</span></P> Wed, 29 Oct 2014 21:38:28 GMT https://community.splunk.com/t5/Splunk-Search/How-to-make-a-table-containing-columns-with-non-empty-values-or/m-p/188712#M54376 martin_mueller 2014-10-29T21:38:28Z Re: How to make a table containing columns with non-empty values (or other criteria) from non-indexed data? https://community.splunk.com/t5/Splunk-Search/How-to-make-a-table-containing-columns-with-non-empty-values-or/m-p/188713#M54377 <P>I like this version. It comes out close to 50% faster in my slightly-scientific tests. Thanks!</P> Thu, 30 Oct 2014 21:08:54 GMT https://community.splunk.com/t5/Splunk-Search/How-to-make-a-table-containing-columns-with-non-empty-values-or/m-p/188713#M54377 halr9000 2014-10-30T21:08:54Z Re: How to make a table containing columns with non-empty values (or other criteria) from non-indexed data? https://community.splunk.com/t5/Splunk-Search/How-to-make-a-table-containing-columns-with-non-empty-values-or/m-p/188714#M54378 <P>I gave ya points. <span class="lia-unicode-emoji" title=":slightly_smiling_face:">๐Ÿ™‚</span></P> Thu, 30 Oct 2014 21:09:35 GMT https://community.splunk.com/t5/Splunk-Search/How-to-make-a-table-containing-columns-with-non-empty-values-or/m-p/188714#M54378 halr9000 2014-10-30T21:09:35Z