Splunk Search

Remove rows with NULL from final search output

gingyish
New Member

My working query returns a table with some NULL fields. This is because the query match the initial result with a lookup table.

How can I remove exclude all entries with atleast 1 NULL field from the final table?

Working Code:

   sourcetype="WinEventLog:ForwardedEvents"  EventCode=XXX field46="*" | rex field=field46 "(?<ip>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\:)(?<ports>\d+)\s+\w+\W(?<Account>.*)" | dedup ip Account| stats values(ip) as Source_IP dc(ip) as count by Account| sort count desc | table Account count | head 100 | lookup GenericAccountDumpList Account OUTPUTNEW Column1 Column2 Column3 

Result

Account      Count       Column1  Column2  Column3 
Anna           100           abc            cde            efg 
Brad           9             xyz            jjj             jlm
Terry          71            qyn            jjj             jlm
Andy           78            qyn                                     -> must be excluded, some columns are NULL / empty 
Maria          30                                                       -> must be excluded, some columns are NULL / empty 
0 Karma
1 Solution

HiroshiSatoh
Champion

If field names are fixed

(your search)|search Column1=*  Column2=*  Column3=*

View solution in original post

HiroshiSatoh
Champion

If field names are fixed

(your search)|search Column1=*  Column2=*  Column3=*
Get Updates on the Splunk Community!

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...

Index This | What goes away as soon as you talk about it?

May 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...

What's New in Splunk Observability Cloud and Splunk AppDynamics - May 2025

This month, we’re delivering several new innovations in Splunk Observability Cloud and Splunk AppDynamics ...