Dashboards & Visualizations

Why are the empty columns dropped by table in the dashboard but not in the standalone search box?

Min1025
New Member

Hi all,

I have a dashboard, some fields don't have values, the empty columns are being dropped by the table in the dashboard, but when I run this query in a standalone search box, these empty columns are displaying. How can I get these empty columns returned in the dashboard as well?

For example:(This panel created with a post process)

Base search: `fieldA=<valueA> fieldB=<valueB> |fields fieldC, fieldD, fieldE, fieldF, fieldG, fieldH`

Search: `|eval field1=fieldC- fieldD |eval field2=fieldE- fieldF |eval field3=fieldG- fieldH |table field1, field2, field3`

The table in standalone search appears like:

field1 field2 field3
< value2>

The table in dashboard appears like:

 field1  field2
    <value1>   <value2>

The empty column field3 is dropped in dashboard, how can I get this column displayed in dashboard?

Tags (3)
0 Karma
1 Solution

niketn
Legend

@Min1025, even in your standalone search if you click on field3 (to apply sort) it will get removed. What is the reason for your to display field with null values? Can you use fillnull command or else eval with isnull() to replace NULL with some default value like 0 or N/A

Also, hopefully you have referred to best practices for post -processing and are using a transforming command in your base search

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

0 Karma

niketn
Legend

@Min1025, even in your standalone search if you click on field3 (to apply sort) it will get removed. What is the reason for your to display field with null values? Can you use fillnull command or else eval with isnull() to replace NULL with some default value like 0 or N/A

Also, hopefully you have referred to best practices for post -processing and are using a transforming command in your base search

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

Min1025
New Member

@niketnilay, Thank you, the empty columns are returning when I use eval with isnull() to replace NULL with value " ".

0 Karma

niketn
Legend

@Min1025 I have converted my comment to answer. Please accept to mark this question as answered!

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Updates (ESCU) - New Releases

In the last month, the Splunk Threat Research Team (STRT) has had 3 releases of new content via the Enterprise ...

Thought Leaders are Validating Your Hard Work and Training Rigor

As a Splunk enthusiast and member of the Splunk Community, you are one of thousands who recognize the value of ...

.conf23 Registration is Now Open!

Time to toss the .conf-etti &#x1f389; —  .conf23 registration is open!   Join us in Las Vegas July 17-20 for ...