How to hide a column in a table if every value in that column is null?

[yacht_rock]

How can I hide/not display a column in a table if every value in that column is null? Sometimes the column will have values. Splunk does a weird table width vs. Length of column values so I'm trying to save space and decrease horizontal scrolling if I can.

Stats count by foo, boo, bar

Foo, boo, bar
123,456,null
123,890,null

Only want to see

Foo, boo
123,456
123,890

if bar is always null

[nabeel652]

Try appending this at the end of your search:

...your search | streamstats count as serial | stats values(*) as * by serial  | fields - serial

[Gayatri]

your search | streamstats count as serial | stats values(*) as * by serial  | fields - serial 

Could you please explain how this command helps to hid columns which has null values in Splunk. 

[romanwaldecker]

Appending the transpose command two times will help you out.

I am referring to this answer in a similar thread:
https://answers.splunk.com/answers/241186/removing-null-columns-from-a-table.html#answer-593190

Simply add:

| transpose 0
| transpose 0 header_field=column 
| fields - column

//

Some further notes:
- Why it works: When transposing a table, Splunk automatically removes every resulting empty row (= previously empty column).
- The 0option makes sure that every row and every column gets transposed.
- The only downside: The transpose command is pretty time-consuming. Use it carefully.
- For further info in Splunk Doku: https://docs.splunk.com/Documentation/Splunk/7.0.2/SearchReference/Transpose

[mprreddy51]

try this

base query....|fields - bar

[yacht_rock]

Thank you for the reply, but that's not quite what I'm asking. I know you can explicitly exclude fields in a search's output via the fields command.

What I'm looking for is conditionally not showing a field if all the field's values are null, otherwise show the field

index=myindex xyz=abc | if (values(whatever_field) = null) then (table foo_field, bar_field) ELSE (table foo_field, bar_field, whatever_field))