Splunk Search

How do I remove empty rows in the result fields?

leninkp3005
Explorer

Folks !!

I'm struggling with removing empty rows from the result fields in my results. In my results, i've got many empty rows.

Kindly assist this case.

Unable to upload/attach my sheet, sorry for the inconvenience.

Cheers,
Lenin K

Tags (1)
1 Solution

iamarkaprabha
Contributor

Hi leninkp3005,

You can use field!=null for this one.
If you want to use those null fields you can use fillnull command
fillnull fills all the null values in the results of a specific field/fields/all fields with a value (defaulted as 0)
|fillnull FIELD value="N/A"

View solution in original post

iamarkaprabha
Contributor

Hi leninkp3005,

You can use field!=null for this one.
If you want to use those null fields you can use fillnull command
fillnull fills all the null values in the results of a specific field/fields/all fields with a value (defaulted as 0)
|fillnull FIELD value="N/A"

leninkp3005
Explorer

Hi,
Used that last query. It's working fine.

Thanks.

0 Karma

iamarkaprabha
Contributor

You are welcome!

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@leninkp3005

you can use where or search after your result.

|where isnotnull(field1)

OR

|search field1=*

leninkp3005
Explorer

Hello Kamlesh,

It's working for me, thanks for your support.

Cheers,
Lenin Kp

0 Karma
Get Updates on the Splunk Community!

Unlock Database Monitoring with Splunk Observability Cloud

  In today’s fast-paced digital landscape, even minor database slowdowns can disrupt user experiences and ...

Purpose in Action: How Splunk Is Helping Power an Inclusive Future for All

At Cisco, purpose isn’t a tagline—it’s a commitment. Cisco’s FY25 Purpose Report outlines how the company is ...

[Upcoming Webinar] Demo Day: Transforming IT Operations with Splunk

Join us for a live Demo Day at the Cisco Store on January 21st 10:00am - 11:00am PST In the fast-paced world ...