How can I hide/not display a column in a table if every value in that column is null? Sometimes the column will have values. Splunk does a weird table width vs. Length of column values so I'm trying to save space and decrease horizontal scrolling if I can.
Stats count by foo, boo, bar
Foo, boo, bar
Only want to see
if bar is always null
transpose command two times will help you out.
I am referring to this answer in a similar thread:
| transpose 0 | transpose 0 header_field=column | fields - column
Some further notes:
- Why it works: When transposing a table, Splunk automatically removes every resulting empty row (= previously empty column).
0option makes sure that every row and every column gets transposed.
- The only downside: The
transpose command is pretty time-consuming. Use it carefully.
- For further info in Splunk Doku: https://docs.splunk.com/Documentation/Splunk/7.0.2/SearchReference/Transpose
Thank you for the reply, but that's not quite what I'm asking. I know you can explicitly exclude fields in a search's output via the fields command.
What I'm looking for is conditionally not showing a field if all the field's values are null, otherwise show the field
index=myindex xyz=abc | if (values(whatever_field) = null) then (table foo_field, bar_field) ELSE (table foo_field, bar_field, whatever_field))