Splunk Search

How to remove columns from search results when they are empty?

JoshuaJohn
Contributor

I am trying to remove columns from my search when they return null. Previously, my entire panel would just result with "no results found", but I wanted to display something here instead of that message, so I appended a column, but when I tried to use fields - (column names), nothing really happened.

Here is my search:

index="nitro_prod_summary" earliest=-1h@m latest=@m [| `nitro_prod_cmdb` | search Category="merch" Service="*" Application="*" | search Application!="LOD" | stats count by Application | table Application] | join Application [ | `nitro_prod_cmdb` ] | search Alert_Type="*" Metric_Category="*" | eval FilterKey=Description.ID | dedup FilterKey |search Category!="FINANCE" | table Alert_Type Category Service Application Metric_Category Description Key ID | rename Metric_Category as "Type" Alert_Type as "Alert" count as Count | sort +Alert | appendpipe  [stats  count | eval  "Active Alerts"="None" | where  count==0 | fields  - count] 

I tried:
fields - count, Alert_Type, Category, Service, Application, Metric_Category, Description, Key, ID
fields - count Alert_Type Category Service Application Metric_Category Description Key ID
fields -

Any Ideas?

0 Karma

somesoni2
Revered Legend

Try this

...your search till appendpipe...| appendpipe  [stats  count | eval  "Active Alerts"="None" | where  count=0 | table "Active Alerts"] 
0 Karma

JoshuaJohn
Contributor

Unfortunately this did not work.

0 Karma
Get Updates on the Splunk Community!

Data Management Digest – December 2025

Welcome to the December edition of Data Management Digest! As we continue our journey of data innovation, the ...

Index This | What is broken 80% of the time by February?

December 2025 Edition   Hayyy Splunk Education Enthusiasts and the Eternally Curious!    We’re back with this ...

Unlock Faster Time-to-Value on Edge and Ingest Processor with New SPL2 Pipeline ...

Hello Splunk Community,   We're thrilled to share an exciting update that will help you manage your data more ...