Splunk Search

Removing null columns from a table

hogan24
Path Finder

I've found some previous posts with similar questions but the results dont seem to be correct so I'm hoping someone can help with this one...

I have something like this:
mysearch | table column1 column2 column3

With results like this:
column1 --- column2 --- column 3
asdfasdf --- 123456
bsdfasdf --- 234567
csdfasdf --- 345678

Sometimes column3 will have data, sometimes it wont. How (after piping to table) can I remove column3 if it has no data (and preferably keep the columns in order as well)? Thanks.

nick405060
Motivator

I downvoted this post because this doesn't answer the question.

0 Karma

arorarahul23
New Member

Above answer is not working in splunk 6.5 version

0 Karma

romanwaldecker
Path Finder

This should be a comment to the mentioned answer rather than another 'answer'. Very misleading as the order of answers changes.

0 Karma

jeffland
SplunkTrust
SplunkTrust

If you don't want to show column 3, don't include it in your table command.

Other than that, how do you think it would work? You can either have a column or don't have it, but you can't have it in some results only - although in a way, that is exactly what happens with a row which is empty in column 3 - it doesn't have a value for column 3. If you could try to show me an example of how the table would look like the way you want it, that would be great.

If you don't want to display empty fields, you could use

your search | table column1 column2 column3 | fillnull column3 ("No entry for column 3")

to have them display that text instead.

0 Karma

hogan24
Path Finder

@jeffland, this is a comment, not an answer. can you delete this as an answer?

"...how do you think it would work?" That's what i'm asking.

I want to include it in the table b/c it may have data. I want to include all columns that may have data. Then remove the column if it does not have data.

0 Karma

jeffland
SplunkTrust
SplunkTrust

Let me rephrase that question: What do you want to see?

I can't imagine how a table would look that has a third column sometimes and sometimes it doesn't. Should the first page of results contain such a column while the second page doesn't?

0 Karma

MichaelPriest
Communicator

So when you do the search column 3 sometimes contains data and other times it doesn't, and when it doesn't the column should be removed?

0 Karma

hogan24
Path Finder

Correct. This is for a dashboard view that I will be turning over to users so I want to simplify the view if a column does not have data.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...