Splunk Search

How to hide a column in a table if every value in that column is null?


How can I hide/not display a column in a table if every value in that column is null? Sometimes the column will have values. Splunk does a weird table width vs. Length of column values so I'm trying to save space and decrease horizontal scrolling if I can.

Stats count by foo, boo, bar

Foo, boo, bar

Only want to see

Foo, boo

if bar is always null


Try appending this at the end of your search:

...your search | streamstats count as serial | stats values(*) as * by serial  | fields - serial

Path Finder

Appending the transpose command two times will help you out.

I am referring to this answer in a similar thread:

Simply add:

| transpose 0
| transpose 0 header_field=column 
| fields - column


Some further notes:
- Why it works: When transposing a table, Splunk automatically removes every resulting empty row (= previously empty column).
- The 0option makes sure that every row and every column gets transposed.
- The only downside: The transpose command is pretty time-consuming. Use it carefully.
- For further info in Splunk Doku: https://docs.splunk.com/Documentation/Splunk/7.0.2/SearchReference/Transpose

0 Karma


try this

base query....|fields - bar

0 Karma


Thank you for the reply, but that's not quite what I'm asking. I know you can explicitly exclude fields in a search's output via the fields command.

What I'm looking for is conditionally not showing a field if all the field's values are null, otherwise show the field

index=myindex xyz=abc | if (values(whatever_field) = null) then (table foo_field, bar_field) ELSE (table foo_field, bar_field, whatever_field))

State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!