Can you help us build a query that removes null values from a table?

[roopeshetty]

Hi guys,

Our search query is like this

LogName=Application SourceName=Script | rex "Days Remaining: (?.*)days" | rex ": Origin=(?.+?)\," | rex (?.+?)\; | table CertificateName, DaysRemaining

Output will provide us a table with 2 columns as “CertificateName” and “DaysRemaining” in which “CertificateName” will have the names of the Certificates and “DaysRemaining” will have the days left for certificate expiry.

But sometimes, the “DaysRemaining” column will have not any numbers for few of the “CertificateNames” and remains blank as attached here in the screen shot.

Is there any way...

1. We can remove the rows which have no values (blank rows) using the above query?
2. Can we input some text string like “Not Available” where ever we have these null values using the above query?

Please advise.

[vnravikumar]

Hi @roopeshetty

Try like

LogName=Application SourceName=Script | rex "Days Remaining: (?.)days" | rex ": Origin=(?.+?)\," | rex (?.+?)\; |search DaysRemaining=* | table CertificateName, DaysRemaining

This will remove null row of DaysRemaining

[vnravikumar]

you can try | fillnull value="Not Available" DaysRemaining