Splunk Search

Exclude empty fields from search

plcd63
Explorer

Dear Splunk Community,

I'm trying to extract a list of changed fields, but they should only be listed if they have a value.

 

 

<mysearch> | eval _raw="DeviceName:" . host ."
" . if(len(srcaddr)>0,"PolicySrc:" . srcaddr,"") ."
" . if(len(dstaddr)>0,"PolicyDst:" . dstaddr,"") ."
" . if(len(service)>0,"PolicySvc:" . service,"") ."

 

 

With len>0 I managed to hide the fields that have not changed, but in the results they are still there as a line break, e.g.

 

 

DeviceName: test

PolicyDst: dest1
PolicySvc svc1

 

 

How can I get rid of these line break(s)?

Labels (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Does this work for you?

<mysearch> | eval _raw="DeviceName:" . host . if(len(srcaddr)>0,"
PolicySrc:" . srcaddr,"") . if(len(dstaddr)>0,"
PolicyDst:" . dstaddr,"") . if(len(service)>0,"
PolicySvc:" . service,"")

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

The eval command as written will insert a newline regardless of the value of len.  I suggest removing blank lines afterwards.

<mysearch> | eval _raw="DeviceName:" . host ."
" . if(len(srcaddr)>0,"PolicySrc:" . srcaddr,"") ."
" . if(len(dstaddr)>0,"PolicyDst:" . dstaddr,"") ."
" . if(len(service)>0,"PolicySvc:" . service,"") ."
```Remove blank lines```
| rex mode=sed "s/\n\n/\n/g"
---
If this reply helps you, Karma would be appreciated.

plcd63
Explorer

This also works. Many thanks!

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Does this work for you?

<mysearch> | eval _raw="DeviceName:" . host . if(len(srcaddr)>0,"
PolicySrc:" . srcaddr,"") . if(len(dstaddr)>0,"
PolicyDst:" . dstaddr,"") . if(len(service)>0,"
PolicySvc:" . service,"")

plcd63
Explorer

Thank you :)!

0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...