If I have missing data from a table, the whole list fails to display. How do work around this issue?

[IRHM73]

Hi, I wonder whether someone may be able to help me please.

I'm using the search below to produce data in the following format

First Name
Surname
DOB
NINO
SUT

auditSource="matching" auditType="Tx*" detail.input-ida-request="*" | rex field="detail.output-cid-response" "\"firstName\":\"(?<cidFName>[^\"]+)" |  rex field="detail.output-cid-response" "\"lastName\":\"(?<cidSName>[^\"]+)" |rex field="detail.output-cid-response" "\"dateOfBirth\":\"(?<cidDOB>[^\"]+)" | rex field="detail.output-cid-response" "\"sut\":\"(?<cidSUT>[^\"]+)" | rex field="detail.output-cid-response" "\"nino\":\"(?<cidNINO>[^\"]+)" | eval Full_Details= "Firstname: ".cidFName.", Surname: ".cidSName.", DOB: ".cidDOB.", NINO: ".cidNINO.", SUT: ".cidSUT | makemv delim=", " Full_Details | table detail.output-cid-response Full_Details

The problem I have is that if there is one piece of information missing from the source data, the whole list fails to display.

Could someone tell me please, is there a way to overcome this?

Many thanks and kind regards

Chris

[IRHM73 · Accepted solution]

All,

For those of you who are interested, I found a solution here where I used Example 2 .

Kind Regards

Chris

[MuS]

You should provide a sample of your events; best to include good and bad examples 😉

[IRHM73]

Hi @MuS, thank you for taking the time to come back to me with this.

I've continued to work on this, and it may not be the best way, but I found a solution here where I used Example 2.

Many thanks and kind regards