Dashboards & Visualizations

How to hide empty columns in a table on a simple XML dashboard?

djluke
Path Finder

Hi all,
I'm going crazy with a table in Splunk.
What I'm trying to do is to dynamically create a table based on non null fields in my events.
I'm using a Simple XML dashboard.
This is the environment:

Event1: _time  fieldA=<valueA>  fieldB=<valueB>  fieldC=<valueC>  fieldD=<valueD>  fieldE=<valueE>
Event2: _time  fieldA=<valueA>  fieldB=<valueB>  fieldC=<valueC>  fieldF=<valueF>  fieldG=<valueG>
Event3: ...

If I use a search string like this

index=<my_index> fieldD=<valueD> | table *

The generated table appears like

_time    fieldA    fieldB    fieldC    fieldD    fieldE    fieldF    fieldG
<time>   <valueA>  <valueB>  <valueC>  <valueD>  <valueE>

Why does Splunk show the empty columns too?
How can I change my search to solve this issue?
Maybe it seems an easy thing but I'm not finding a solution.
Help me please! 🙂

nida__firdous
New Member

@djluke

add this query end of your query .

| streamstats count as temp_count
  | stats values(*) as * by temp_count
  | fields - temp_count
0 Karma

stephane_cyrill
Builder

With a search such as ……. ….|table *** If you desire for exemle to remove a Colum on the displayed result, you can transform your search to **...|table * |fields – fieldName where fieldName is the field you don’t want to display.
You can do it for many fields at once like this ….|table * |fields – fieldName1, fieldName2,…

This is an exemple that display all fields except the fields host an index

index=* |table *|fields - host ,index

0 Karma

djluke
Path Finder

Thanks for your answer.
I already knew there was the possibility to "filter" results using the fields command, but my question was related to the results shown by "table" command.
I can't predict which columns will be empty or filled before launching the search function. I'd like splunk to show me only NOT NULL columns.
Is it possible?
Thanks

0 Karma

splunk_newer1
Engager

Hi, 

I am also facing this issue of displaying  only NOT NULL columns. in splunk table.

Can someone help in this?

 

thanks

0 Karma
Get Updates on the Splunk Community!

Learn Splunk Insider Insights, Do More With Gen AI, & Find 20+ New Use Cases You Can ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Buttercup Games: Further Dashboarding Techniques (Part 7)

This series of blogs assumes you have already completed the Splunk Enterprise Search Tutorial as it uses the ...

Stay Connected: Your Guide to April Tech Talks, Office Hours, and Webinars!

What are Community Office Hours? Community Office Hours is an interactive 60-minute Zoom series where ...