Dashboards & Visualizations

Why are the empty columns dropped by table in the dashboard but not in the standalone search box?

Min1025
Explorer

Hi all,

I have a dashboard, some fields don't have values, the empty columns are being dropped by the table in the dashboard, but when I run this query in a standalone search box, these empty columns are displaying. How can I get these empty columns returned in the dashboard as well?

For example:(This panel created with a post process)

Base search: `fieldA=<valueA> fieldB=<valueB> |fields fieldC, fieldD, fieldE, fieldF, fieldG, fieldH`

Search: `|eval field1=fieldC- fieldD |eval field2=fieldE- fieldF |eval field3=fieldG- fieldH |table field1, field2, field3`

The table in standalone search appears like:

field1 field2 field3
< value2>

The table in dashboard appears like:

 field1  field2
    <value1>   <value2>

The empty column field3 is dropped in dashboard, how can I get this column displayed in dashboard?

Tags (3)
0 Karma
1 Solution

niketn
Legend

@Min1025, even in your standalone search if you click on field3 (to apply sort) it will get removed. What is the reason for your to display field with null values? Can you use fillnull command or else eval with isnull() to replace NULL with some default value like 0 or N/A

Also, hopefully you have referred to best practices for post -processing and are using a transforming command in your base search

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

0 Karma

niketn
Legend

@Min1025, even in your standalone search if you click on field3 (to apply sort) it will get removed. What is the reason for your to display field with null values? Can you use fillnull command or else eval with isnull() to replace NULL with some default value like 0 or N/A

Also, hopefully you have referred to best practices for post -processing and are using a transforming command in your base search

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

Min1025
Explorer

@niketnilay, Thank you, the empty columns are returning when I use eval with isnull() to replace NULL with value " ".

0 Karma

niketn
Legend

@Min1025 I have converted my comment to answer. Please accept to mark this question as answered!

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...

Edge Processor Scaling, Energy & Manufacturing Use Cases, and More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Get More Out of Your Security Practice With a SIEM

Get More Out of Your Security Practice With a SIEMWednesday, July 31, 2024  |  11AM PT / 2PM ETREGISTER ...