Splunk Search

Exclude empty fields from search

plcd63
Explorer

Dear Splunk Community,

I'm trying to extract a list of changed fields, but they should only be listed if they have a value.

 

 

<mysearch> | eval _raw="DeviceName:" . host ."
" . if(len(srcaddr)>0,"PolicySrc:" . srcaddr,"") ."
" . if(len(dstaddr)>0,"PolicyDst:" . dstaddr,"") ."
" . if(len(service)>0,"PolicySvc:" . service,"") ."

 

 

With len>0 I managed to hide the fields that have not changed, but in the results they are still there as a line break, e.g.

 

 

DeviceName: test

PolicyDst: dest1
PolicySvc svc1

 

 

How can I get rid of these line break(s)?

Labels (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Does this work for you?

<mysearch> | eval _raw="DeviceName:" . host . if(len(srcaddr)>0,"
PolicySrc:" . srcaddr,"") . if(len(dstaddr)>0,"
PolicyDst:" . dstaddr,"") . if(len(service)>0,"
PolicySvc:" . service,"")

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

The eval command as written will insert a newline regardless of the value of len.  I suggest removing blank lines afterwards.

<mysearch> | eval _raw="DeviceName:" . host ."
" . if(len(srcaddr)>0,"PolicySrc:" . srcaddr,"") ."
" . if(len(dstaddr)>0,"PolicyDst:" . dstaddr,"") ."
" . if(len(service)>0,"PolicySvc:" . service,"") ."
```Remove blank lines```
| rex mode=sed "s/\n\n/\n/g"
---
If this reply helps you, Karma would be appreciated.

plcd63
Explorer

This also works. Many thanks!

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Does this work for you?

<mysearch> | eval _raw="DeviceName:" . host . if(len(srcaddr)>0,"
PolicySrc:" . srcaddr,"") . if(len(dstaddr)>0,"
PolicyDst:" . dstaddr,"") . if(len(service)>0,"
PolicySvc:" . service,"")

plcd63
Explorer

Thank you :)!

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...