Dashboards & Visualizations

Why are the empty columns dropped by table in the dashboard but not in the standalone search box?

Min1025
Explorer

Hi all,

I have a dashboard, some fields don't have values, the empty columns are being dropped by the table in the dashboard, but when I run this query in a standalone search box, these empty columns are displaying. How can I get these empty columns returned in the dashboard as well?

For example:(This panel created with a post process)

Base search: `fieldA=<valueA> fieldB=<valueB> |fields fieldC, fieldD, fieldE, fieldF, fieldG, fieldH`

Search: `|eval field1=fieldC- fieldD |eval field2=fieldE- fieldF |eval field3=fieldG- fieldH |table field1, field2, field3`

The table in standalone search appears like:

field1 field2 field3
< value2>

The table in dashboard appears like:

 field1  field2
    <value1>   <value2>

The empty column field3 is dropped in dashboard, how can I get this column displayed in dashboard?

Tags (3)
0 Karma
1 Solution

niketn
Legend

@Min1025, even in your standalone search if you click on field3 (to apply sort) it will get removed. What is the reason for your to display field with null values? Can you use fillnull command or else eval with isnull() to replace NULL with some default value like 0 or N/A

Also, hopefully you have referred to best practices for post -processing and are using a transforming command in your base search

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

0 Karma

niketn
Legend

@Min1025, even in your standalone search if you click on field3 (to apply sort) it will get removed. What is the reason for your to display field with null values? Can you use fillnull command or else eval with isnull() to replace NULL with some default value like 0 or N/A

Also, hopefully you have referred to best practices for post -processing and are using a transforming command in your base search

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

Min1025
Explorer

@niketnilay, Thank you, the empty columns are returning when I use eval with isnull() to replace NULL with value " ".

0 Karma

niketn
Legend

@Min1025 I have converted my comment to answer. Please accept to mark this question as answered!

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Get Updates on the Splunk Community!

.conf25 Registration is OPEN!

Ready. Set. Splunk! Your favorite Splunk user event is back and better than ever. Get ready for more technical ...

Detecting Cross-Channel Fraud with Splunk

This article is the final installment in our three-part series exploring fraud detection techniques using ...

Splunk at Cisco Live 2025: Learning, Innovation, and a Little Bit of Mr. Brightside

Pack your bags (and maybe your dancing shoes)—Cisco Live is heading to San Diego, June 8–12, 2025, and Splunk ...