I'm creating a dashboard that displays event "headers" for certain events,
and a drill down search that will display the full event.
The problem is, a lot of the events come with "empty" fields - instead of being null or non existent, they have -
as the value.
I would like to remove fields that only contain -
, so I will be able to search | table *
and receive a table that only contains fields with data.
Any ideas?
Not sure how efficient this will be for your query, but see this runanywhere sample
| gentimes start=-4 | eval Somesh="-" | table [| gentimes start=-4 | eval Somesh="-" | fieldsummary | search values!="[{\"value\":\"-\",*" | stats values(field) as search delim="," | nomv search]
Not sure how efficient this will be for your query, but see this runanywhere sample
| gentimes start=-4 | eval Somesh="-" | table [| gentimes start=-4 | eval Somesh="-" | fieldsummary | search values!="[{\"value\":\"-\",*" | stats values(field) as search delim="," | nomv search]
This does the trick, I wasn't aware that you can put a sub query after table.
Try appending this before the table:
| query
| search NOT yourfieldname="-"
| table *
If that's not exactly what you are looking for please give us an example and ideally post the query here.