topic Re: Why I am not seeing the headers for columns that have all null values? in Splunk Search

Why I am not seeing the headers for columns that have all null values?

sandeepkumarmis — Tue, 05 Apr 2016 17:59:13 GMT

Hello,

I am using a curl command to extract data from Splunk. When at least one value for the column is there, I can see the header for that column, but when the entire column is null, I don't see the header itself. Can some one help me to fix this?

Re: Why I am not seeing the headers for columns that have all null values?

arobbins_splunk — Tue, 29 Sep 2020 09:21:46 GMT

if you're using the preview_results endpoint with output_mode:json_rows, you should be able to set the field_list to include the fields you want. Those fields then should come back even if all the values are NULL.

Re: Why I am not seeing the headers for columns that have all null values?

sandeepkumarmis — Tue, 05 Apr 2016 18:48:36 GMT

I am using output_mod:csv.
I found this can not be done. 😞
http://docs.splunk.com/Documentation/Splunk/6.0/Data/Extractfieldsfromfileheadersatindextime

Re: Why I am not seeing the headers for columns that have all null values?

jkat54 — Tue, 05 Apr 2016 21:19:58 GMT

Use the fillnull command to fill the null values...

root search... | fillnull value=null | ... statistical/charting command

Re: Why I am not seeing the headers for columns that have all null values?

sandeepkumarmis — Wed, 06 Apr 2016 15:12:41 GMT

I tried this as well, but still I neither get the field null values nor the header names.

Re: Why I am not seeing the headers for columns that have all null values?

jkat54 — Wed, 06 Apr 2016 15:58:17 GMT

Can you please share the search?

Re: Why I am not seeing the headers for columns that have all null values?

sandeepkumarmis — Wed, 06 Apr 2016 16:13:00 GMT

curl -k -u  https://url  -d search="search index=   sourcetype= earliest=-30d latest=now | fillnull value=null |  sort -_time | rename _time AS time | convert ctime(time) | table field1,field2,field3,field4,field5,field5" -d output_mode=csv -o /home/username/test.csv

Output
field5
608
214
407
860
219
901
843
904
480

I am expecting something like
field1,field2,field3,field4,field5
,,,,608
,,,,214
,,,,407
,,,,860
,,,,219
,,,,901
,,,,843
,,,,904
,,,,480

Re: Why I am not seeing the headers for columns that have all null values?

arobbins_splunk — Wed, 06 Apr 2016 16:36:36 GMT

OK... so since field1,field2,field3,field4 are null when you get to the pipe with fillnull, the search processor doesn't know that they exist, and therefore cannot fill them with null...

try:
... | fillnull value=NULL field1,field2,field3,field4,field5 | ...

that should explicitly tell the fillnull processor that those fields exist and need to be set.

Re: Why I am not seeing the headers for columns that have all null values?

sundareshr — Wed, 06 Apr 2016 16:39:05 GMT

Try uppercase null .. | fillnull value=NULL

Re: Why I am not seeing the headers for columns that have all null values?

jkat54 — Wed, 06 Apr 2016 18:01:07 GMT

What API endpoint are you using? You only mention URL not /saved/searches/ ... etc

Re: Why I am not seeing the headers for columns that have all null values?

jkat54 — Wed, 06 Apr 2016 18:42:31 GMT

I have a work around... i've seen this before and the conclusion is the API doesnt export the null values. This is the work around:

search index=indexname
| sort - _time 
| rename _time AS time 
| convert ctime(time)  
| eval fielda=if(isnull(fielda),",",fielda)
| eval fieldb=if(isnull(fieldb),",",fieldb)
| eval fieldc=if(isnull(fieldc),",",fieldc)
| eval fieldd=if(isnull(fieldd),",",fieldd)
| eval fielde=if(isnull(fielde),",",fielde)
| table fielda fieldb fieldc fieldd fielde

What it will do is replace null values with commas and then the API is forced to export in correct csv format.

Re: Why I am not seeing the headers for columns that have all null values?

jkat54 — Wed, 06 Apr 2016 19:59:30 GMT

You can probably do this several other ways like the 'fill null value="," (fields here)'