https://community.splunk.com/t5/Splunk-Search/Remove-rows-with-NULL-from-final-search-output/m-p/301587#M90809 <P>My working query returns a table with some NULL fields. This is because the query match the initial result with a lookup table. </P> <P>How can I remove exclude all entries with atleast 1 NULL field from the final table? </P> <P>Working Code: </P> <PRE><CODE> sourcetype="WinEventLog:ForwardedEvents" EventCode=XXX field46="*" | rex field=field46 "(?&lt;ip&gt;\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\:)(?&lt;ports&gt;\d+)\s+\w+\W(?&lt;Account&gt;.*)" | dedup ip Account| stats values(ip) as Source_IP dc(ip) as count by Account| sort count desc | table Account count | head 100 | lookup GenericAccountDumpList Account OUTPUTNEW Column1 Column2 Column3 </CODE></PRE> <P>Result </P> <PRE><CODE>Account Count Column1 Column2 Column3 Anna 100 abc cde efg Brad 9 xyz jjj jlm Terry 71 qyn jjj jlm Andy 78 qyn -&gt; must be excluded, some columns are NULL / empty Maria 30 -&gt; must be excluded, some columns are NULL / empty </CODE></PRE> Thu, 11 Jan 2018 01:11:36 GMT gingyish 2018-01-11T01:11:36Z https://community.splunk.com/t5/Splunk-Search/Remove-rows-with-NULL-from-final-search-output/m-p/301587#M90809 <P>My working query returns a table with some NULL fields. This is because the query match the initial result with a lookup table. </P> <P>How can I remove exclude all entries with atleast 1 NULL field from the final table? </P> <P>Working Code: </P> <PRE><CODE> sourcetype="WinEventLog:ForwardedEvents" EventCode=XXX field46="*" | rex field=field46 "(?&lt;ip&gt;\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\:)(?&lt;ports&gt;\d+)\s+\w+\W(?&lt;Account&gt;.*)" | dedup ip Account| stats values(ip) as Source_IP dc(ip) as count by Account| sort count desc | table Account count | head 100 | lookup GenericAccountDumpList Account OUTPUTNEW Column1 Column2 Column3 </CODE></PRE> <P>Result </P> <PRE><CODE>Account Count Column1 Column2 Column3 Anna 100 abc cde efg Brad 9 xyz jjj jlm Terry 71 qyn jjj jlm Andy 78 qyn -&gt; must be excluded, some columns are NULL / empty Maria 30 -&gt; must be excluded, some columns are NULL / empty </CODE></PRE> Thu, 11 Jan 2018 01:11:36 GMT https://community.splunk.com/t5/Splunk-Search/Remove-rows-with-NULL-from-final-search-output/m-p/301587#M90809 gingyish 2018-01-11T01:11:36Z https://community.splunk.com/t5/Splunk-Search/Remove-rows-with-NULL-from-final-search-output/m-p/301588#M90810 <P>If field names are fixed</P> <PRE><CODE>(your search)|search Column1=* Column2=* Column3=* </CODE></PRE> Thu, 11 Jan 2018 01:43:06 GMT https://community.splunk.com/t5/Splunk-Search/Remove-rows-with-NULL-from-final-search-output/m-p/301588#M90810 HiroshiSatoh 2018-01-11T01:43:06Z