Exclude empty fields from search

[plcd63]

Dear Splunk Community,

I'm trying to extract a list of changed fields, but they should only be listed if they have a value.

<mysearch> | eval _raw="DeviceName:" . host ."
" . if(len(srcaddr)>0,"PolicySrc:" . srcaddr,"") ."
" . if(len(dstaddr)>0,"PolicyDst:" . dstaddr,"") ."
" . if(len(service)>0,"PolicySvc:" . service,"") ."

With len>0 I managed to hide the fields that have not changed, but in the results they are still there as a line break, e.g.

DeviceName: test

PolicyDst: dest1
PolicySvc svc1

How can I get rid of these line break(s)?

[richgalloway]

The eval command as written will insert a newline regardless of the value of len.  I suggest removing blank lines afterwards.

<mysearch> | eval _raw="DeviceName:" . host ."
" . if(len(srcaddr)>0,"PolicySrc:" . srcaddr,"") ."
" . if(len(dstaddr)>0,"PolicyDst:" . dstaddr,"") ."
" . if(len(service)>0,"PolicySvc:" . service,"") ."
```Remove blank lines```
| rex mode=sed "s/\n\n/\n/g"

[plcd63]

This also works. Many thanks!

[ITWhisperer · Accepted solution]

Does this work for you?

<mysearch> | eval _raw="DeviceName:" . host . if(len(srcaddr)>0,"
PolicySrc:" . srcaddr,"") . if(len(dstaddr)>0,"
PolicyDst:" . dstaddr,"") . if(len(service)>0,"
PolicySvc:" . service,"")

[plcd63]

Thank you :)!