Reporting

Eliminating empty records from display

Jananee_iNautix
Path Finder

Hi,

I have a report displayed in table format .The search query currently includes and displays the records that have all the fields conatining null values in it.There is a requirement to eliminate the records that has the fields containing no values in it. For Example

Filename user server............service
1)
2) abbc ftyfe reg.............ferwe

In the above report record 1) should be eliminated from display .Is there any way to do it.Please advise.

Tags (1)
0 Karma

somesoni2
Revered Legend

Can you post your current search query?

0 Karma

linu1988
Champion

Try

source=test Filename!=""|table *

or

source=test NOT isnull(Filename)|table *

Thanks

0 Karma
Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Dynamic formatting from XML events

This challenge was first posted on Slack #puzzles channelFor a previous puzzle, I needed a set of fixed-length ...

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  🚀 Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Stronger Security with Federated Search for S3, GCP SQL & Australian Threat ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...