Splunk Search

Remove rows with NULL from final search output

gingyish
New Member

My working query returns a table with some NULL fields. This is because the query match the initial result with a lookup table.

How can I remove exclude all entries with atleast 1 NULL field from the final table?

Working Code:

   sourcetype="WinEventLog:ForwardedEvents"  EventCode=XXX field46="*" | rex field=field46 "(?<ip>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\:)(?<ports>\d+)\s+\w+\W(?<Account>.*)" | dedup ip Account| stats values(ip) as Source_IP dc(ip) as count by Account| sort count desc | table Account count | head 100 | lookup GenericAccountDumpList Account OUTPUTNEW Column1 Column2 Column3 

Result

Account      Count       Column1  Column2  Column3 
Anna           100           abc            cde            efg 
Brad           9             xyz            jjj             jlm
Terry          71            qyn            jjj             jlm
Andy           78            qyn                                     -> must be excluded, some columns are NULL / empty 
Maria          30                                                       -> must be excluded, some columns are NULL / empty 
0 Karma
1 Solution

HiroshiSatoh
Champion

If field names are fixed

(your search)|search Column1=*  Column2=*  Column3=*

View solution in original post

HiroshiSatoh
Champion

If field names are fixed

(your search)|search Column1=*  Column2=*  Column3=*
Get Updates on the Splunk Community!

Community Content Calendar, November Edition

Welcome to the November edition of our Community Spotlight! Each month, we dive into the Splunk Community to ...

October Community Champions: A Shoutout to Our Contributors!

As October comes to a close, we want to take a moment to celebrate the people who make the Splunk Community ...

Stay Connected: Your Guide to November Tech Talks, Office Hours, and Webinars!

What are Community Office Hours? Community Office Hours is an interactive 60-minute Zoom series where ...