Dashboards & Visualizations

Why are the empty columns dropped by table in the dashboard but not in the standalone search box?

Min1025
Explorer

Hi all,

I have a dashboard, some fields don't have values, the empty columns are being dropped by the table in the dashboard, but when I run this query in a standalone search box, these empty columns are displaying. How can I get these empty columns returned in the dashboard as well?

For example:(This panel created with a post process)

Base search: `fieldA=<valueA> fieldB=<valueB> |fields fieldC, fieldD, fieldE, fieldF, fieldG, fieldH`

Search: `|eval field1=fieldC- fieldD |eval field2=fieldE- fieldF |eval field3=fieldG- fieldH |table field1, field2, field3`

The table in standalone search appears like:

field1 field2 field3
< value2>

The table in dashboard appears like:

 field1  field2
    <value1>   <value2>

The empty column field3 is dropped in dashboard, how can I get this column displayed in dashboard?

Tags (3)
0 Karma
1 Solution

niketn
Legend

@Min1025, even in your standalone search if you click on field3 (to apply sort) it will get removed. What is the reason for your to display field with null values? Can you use fillnull command or else eval with isnull() to replace NULL with some default value like 0 or N/A

Also, hopefully you have referred to best practices for post -processing and are using a transforming command in your base search

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

0 Karma

niketn
Legend

@Min1025, even in your standalone search if you click on field3 (to apply sort) it will get removed. What is the reason for your to display field with null values? Can you use fillnull command or else eval with isnull() to replace NULL with some default value like 0 or N/A

Also, hopefully you have referred to best practices for post -processing and are using a transforming command in your base search

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

Min1025
Explorer

@niketnilay, Thank you, the empty columns are returning when I use eval with isnull() to replace NULL with value " ".

0 Karma

niketn
Legend

@Min1025 I have converted my comment to answer. Please accept to mark this question as answered!

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Get Updates on the Splunk Community!

Monitoring Postgres with OpenTelemetry

Behind every business-critical application, you’ll find databases. These behind-the-scenes stores power ...

Mastering Synthetic Browser Testing: Pro Tips to Keep Your Web App Running Smoothly

To start, if you're new to synthetic monitoring, I recommend exploring this synthetic monitoring overview. In ...

Splunk Edge Processor | Popular Use Cases to Get Started with Edge Processor

Splunk Edge Processor offers more efficient, flexible data transformation – helping you reduce noise, control ...